Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Windows Analysis Report ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe

Overview

General Information

Sample Name:ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
Analysis ID:458887
MD5:4eb106d21c787c7b4215721673e15b39
SHA1:2600e6b0ea8e3d39d4001ed0f8a35a87fc716566
SHA256:9fcdd20c1848723a889fd4ebb88e52a2cb9fae8ec9e8cfe70d8e9706ef3e8992
Tags:exenull
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AgentTesla
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Antivirus or Machine Learning detection for unpacked file
Binary contains a suspicious time stamp
Contains functionality to detect virtual machines (SGDT)
Contains functionality to detect virtual machines (SMSW)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • EnhancementRadio.exe (PID: 7104 cmdline: 'C:\Users\user\AppData\Local\EnhancementRadio.exe' MD5: 4EB106D21C787C7B4215721673E15B39)
  • EnhancementRadio.exe (PID: 4308 cmdline: 'C:\Users\user\AppData\Local\EnhancementRadio.exe' MD5: 4EB106D21C787C7B4215721673E15B39)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "serena@mbalikova.com", "Password": "Pp88347521@", "Host": "mail.privateemail.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000017.00000002.471689095.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000017.00000002.471689095.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000001.00000002.378683076.0000000003B78000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000001.00000002.378683076.0000000003B78000.00000004.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
          00000017.00000002.476536239.0000000002C11000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            Click to see the 9 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3c07d60.6.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3c07d60.6.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3bb7d40.4.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3bb7d40.4.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3c07d60.6.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 11 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Jbx Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3c07d60.6.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "serena@mbalikova.com", "Password": "Pp88347521@", "Host": "mail.privateemail.com"}
                      Multi AV Scanner detection for dropped fileShow sources
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeMetadefender: Detection: 40%Perma Link
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeReversingLabs: Detection: 60%
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeMetadefender: Detection: 40%Perma Link
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeReversingLabs: Detection: 60%
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeVirustotal: Detection: 62%Perma Link
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeMetadefender: Detection: 40%Perma Link
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeReversingLabs: Detection: 60%
                      Machine Learning detection for dropped fileShow sources
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeJoe Sandbox ML: detected
                      Machine Learning detection for sampleShow sources
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeJoe Sandbox ML: detected
                      Source: 23.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.476536239.0000000002C11000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.476536239.0000000002C11000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.476536239.0000000002C11000.00000004.00000001.sdmpString found in binary or memory: http://yFwcGw.com
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.378683076.0000000003B78000.00000004.00000001.sdmp, ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.471689095.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.476536239.0000000002C11000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 23.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b8B859ACDu002dEC05u002d4F97u002dA182u002d503756A5D418u007d/u003551ECFC5u002d5F7Au002d4F71u002dA5B9u002dC0011D79C891.csLarge array initialization: .cctor: array initializer size 11762
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 1_2_053F1D0C
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 1_2_053F2580
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 1_2_053F1CDC
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 1_2_053FB078
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 1_2_053FB088
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 1_2_053F3A70
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 1_2_053F3A80
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 1_2_08BF8640
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 1_2_08BF5560
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 1_2_08BF5552
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 1_2_08BF868B
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 1_2_08BF8630
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 23_2_02A046E0
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 23_2_02A045F0
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeCode function: 24_2_0109E7C0
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeCode function: 24_2_0109E7D0
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeCode function: 24_2_0109D6D4
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeCode function: 24_2_08725560
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeCode function: 24_2_08725552
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeCode function: 24_2_08725532
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeCode function: 24_2_08877F90
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeCode function: 26_2_0287E7C3
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeCode function: 26_2_0287E7D0
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeCode function: 26_2_0287D6D4
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeCode function: 26_2_087A7F90
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.382320806.0000000007370000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dllj% vs ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000000.204729570.00000000006BA000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameown.exe vs ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.383035381.0000000008A90000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameWoanfffwean.dll" vs ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.378683076.0000000003B78000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameBVoWIYyQAeyHveWEjGRLxTDoHTkDhenJQ.exe4 vs ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.375325730.0000000002A31000.00000004.00000001.sdmpBinary or memory string: OriginalFilename vs ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.383133526.0000000008B10000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dll.muij% vs ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.381963624.0000000007240000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.375822190.0000000002B18000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameclrjit.dllT vs ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000003.371342233.0000000003C5E000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameJhtolvacgwrosce.dll@ vs ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000000.372930516.000000000087A000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameown.exe vs ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.472265201.0000000000438000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameBVoWIYyQAeyHveWEjGRLxTDoHTkDhenJQ.exe4 vs ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.480718419.00000000050F0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewbemdisp.tlbj% vs ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeBinary or memory string: OriginalFilenameown.exe vs ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: EnhancementRadio.exe.1.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.1.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: 23.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 23.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: classification engineClassification label: mal100.troj.evad.winEXE@5/5@0/0
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeFile created: C:\Users\user\AppData\Local\EnhancementRadio.exeJump to behavior
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeFile created: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeJump to behavior
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeVirustotal: Detection: 62%
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeMetadefender: Detection: 40%
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeReversingLabs: Detection: 60%
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeFile read: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe 'C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe'
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess created: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: unknownProcess created: C:\Users\user\AppData\Local\EnhancementRadio.exe 'C:\Users\user\AppData\Local\EnhancementRadio.exe'
                      Source: unknownProcess created: C:\Users\user\AppData\Local\EnhancementRadio.exe 'C:\Users\user\AppData\Local\EnhancementRadio.exe'
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess created: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32
                      Source: Window RecorderWindow detected: More than 3 window changes detected
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

                      Data Obfuscation:

                      barindex
                      .NET source code contains potential unpackerShow sources
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, Wuxppeyyvhchfuadyyylbmc/Form1.cs.Net Code: InterruptExporter System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: EnhancementRadio.exe.1.dr, Wuxppeyyvhchfuadyyylbmc/Form1.cs.Net Code: InterruptExporter System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.1.dr, Wuxppeyyvhchfuadyyylbmc/Form1.cs.Net Code: InterruptExporter System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.630000.0.unpack, Wuxppeyyvhchfuadyyylbmc/Form1.cs.Net Code: InterruptExporter System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 23.0.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.7f0000.0.unpack, Wuxppeyyvhchfuadyyylbmc/Form1.cs.Net Code: InterruptExporter System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 23.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.7f0000.1.unpack, Wuxppeyyvhchfuadyyylbmc/Form1.cs.Net Code: InterruptExporter System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 24.2.EnhancementRadio.exe.660000.0.unpack, Wuxppeyyvhchfuadyyylbmc/Form1.cs.Net Code: InterruptExporter System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 24.0.EnhancementRadio.exe.660000.0.unpack, Wuxppeyyvhchfuadyyylbmc/Form1.cs.Net Code: InterruptExporter System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 26.0.EnhancementRadio.exe.550000.0.unpack, Wuxppeyyvhchfuadyyylbmc/Form1.cs.Net Code: InterruptExporter System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 26.2.EnhancementRadio.exe.550000.0.unpack, Wuxppeyyvhchfuadyyylbmc/Form1.cs.Net Code: InterruptExporter System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeStatic PE information: 0xB5F6BF93 [Mon Sep 27 21:03:15 2066 UTC]
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 1_2_08BF18AA push ebp; iretd
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeCode function: 23_2_02A0DD78 push FFFFFF8Bh; iretd
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeCode function: 24_2_087218AA push ebp; iretd
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeCode function: 26_2_08AD4D86 push ss; retf
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeFile created: C:\Users\user\AppData\Local\EnhancementRadio.exeJump to dropped file
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeFile created: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeJump to dropped file
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run EnhancementRadioJump to behavior
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run EnhancementRadioJump to behavior
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion:

                      barindex
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.375325730.0000000002A31000.00000004.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.478067132.0000000002BA2000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL0SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeCode function: 24_2_01094291 sgdt fword ptr [eax]
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeCode function: 24_2_01094508 smsw word ptr [eax+55011068h]
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeWindow / User API: threadDelayed 2772
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeWindow / User API: threadDelayed 517
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeWindow / User API: threadDelayed 9327
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeWindow / User API: threadDelayed 421
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe TID: 5336Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe TID: 7132Thread sleep time: -21213755684765971s >= -30000s
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe TID: 7136Thread sleep count: 517 > 30
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe TID: 7136Thread sleep count: 9327 > 30
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeThread delayed: delay time: 922337203685477
                      Source: EnhancementRadio.exe, 00000018.00000002.478067132.0000000002BA2000.00000004.00000001.sdmpBinary or memory string: 0VMware|VIRTUAL|A M I|XenDselect * from Win32_ComputerSystem
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeBinary or memory string: 2cmE/Z35WJiUQh/ZWUm13BeLzq+2PNsSKHXlddu9ZSHgfSCbSOXjO/o8c/PYX2RfnVJv5ecE1bTJ+
                      Source: EnhancementRadio.exe, 00000018.00000002.478067132.0000000002BA2000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000003.371342233.0000000003C5E000.00000004.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.479441536.0000000003AC9000.00000004.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000003.471324933.0000000003DC8000.00000004.00000001.sdmpBinary or memory string: e2cmE/Z35WJiUQh/ZWUm13BeLzq+2PNsSKHXlddu9ZSHgfSCbSOXjO/o8c/PYX2RfnVJv5ecE1bTJ+Zf
                      Source: EnhancementRadio.exe, 00000018.00000002.478067132.0000000002BA2000.00000004.00000001.sdmpBinary or memory string: model0Microsoft|VMWare|Virtual
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess information queried: ProcessInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess token adjusted: Debug
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess token adjusted: Debug
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess token adjusted: Debug
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeMemory allocated: page read and write | page guard

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeMemory written: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe base: 400000 value starts with: 4D5A
                      Writes to foreign memory regionsShow sources
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeMemory written: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe base: 400000
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeMemory written: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe base: 402000
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeMemory written: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe base: 438000
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeMemory written: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe base: 43A000
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeMemory written: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe base: ACE008
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeProcess created: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.475723469.0000000001560000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.475849847.00000000014C0000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.476032487.00000000013E0000.00000002.00000001.sdmpBinary or memory string: Program Manager
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.475723469.0000000001560000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.475849847.00000000014C0000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.476032487.00000000013E0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.475723469.0000000001560000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.475849847.00000000014C0000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.476032487.00000000013E0000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.475723469.0000000001560000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.475849847.00000000014C0000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.476032487.00000000013E0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeQueries volume information: C:\Users\user\AppData\Local\EnhancementRadio.exe VolumeInformation
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeQueries volume information: C:\Users\user\AppData\Local\EnhancementRadio.exe VolumeInformation
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\EnhancementRadio.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3c07d60.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3bb7d40.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3c07d60.6.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3b8fd20.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 23.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3ab0f50.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3a39930.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3bb7d40.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000017.00000002.471689095.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.378683076.0000000003B78000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.378760193.0000000003C07000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.378128189.0000000003A31000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.375822190.0000000002B18000.00000004.00000001.sdmp, type: MEMORY
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3c07d60.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3bb7d40.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3c07d60.6.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3b8fd20.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 23.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3ab0f50.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3a39930.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3bb7d40.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000017.00000002.471689095.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.378683076.0000000003B78000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.378760193.0000000003C07000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.378128189.0000000003A31000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.375822190.0000000002B18000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe PID: 5748, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe PID: 7008, type: MEMORYSTR
                      Source: Yara matchFile source: 00000017.00000002.476536239.0000000002C11000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe PID: 7008, type: MEMORYSTR

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3c07d60.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3bb7d40.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3c07d60.6.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3b8fd20.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 23.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3ab0f50.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3a39930.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3bb7d40.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000017.00000002.471689095.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.378683076.0000000003B78000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.378760193.0000000003C07000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.378128189.0000000003A31000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.375822190.0000000002B18000.00000004.00000001.sdmp, type: MEMORY
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3c07d60.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3bb7d40.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3c07d60.6.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3b8fd20.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 23.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3ab0f50.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3a39930.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.3bb7d40.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000017.00000002.471689095.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.378683076.0000000003B78000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.378760193.0000000003C07000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.378128189.0000000003A31000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.375822190.0000000002B18000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe PID: 5748, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe PID: 7008, type: MEMORYSTR

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211Registry Run Keys / Startup Folder1Process Injection212Masquerading1OS Credential DumpingSecurity Software Discovery311Remote ServicesArchive Collected Data11Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsRegistry Run Keys / Startup Folder1Disable or Modify Tools1LSASS MemoryProcess Discovery2Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion151Security Account ManagerVirtualization/Sandbox Evasion151SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection212NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsSystem Information Discovery113SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information1Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing12DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobTimestomp1Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe63%VirustotalBrowse
                      ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe46%MetadefenderBrowse
                      ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe61%ReversingLabsByteCode-MSIL.Trojan.AgentTesla
                      ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe100%Joe Sandbox ML

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\Users\user\AppData\Local\EnhancementRadio.exe100%Joe Sandbox ML
                      C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe100%Joe Sandbox ML
                      C:\Users\user\AppData\Local\EnhancementRadio.exe46%MetadefenderBrowse
                      C:\Users\user\AppData\Local\EnhancementRadio.exe61%ReversingLabsByteCode-MSIL.Trojan.AgentTesla
                      C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe46%MetadefenderBrowse
                      C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe61%ReversingLabsByteCode-MSIL.Trojan.AgentTesla

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      23.2.ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File

                      Domains

                      No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://yFwcGw.com0%Avira URL Cloudsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe

                      Domains and IPs

                      Contacted Domains

                      No contacted domains info

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://127.0.0.1:HTTP/1.1ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.476536239.0000000002C11000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		low
                      http://www.apache.org/licenses/LICENSE-2.0ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                        		high
                        http://www.fontbureau.comORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                          		high
                          http://www.fontbureau.com/designersGORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                            		high
                            http://DynDns.comDynDNSORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.476536239.0000000002C11000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.com/designers/?ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                              		high
                              http://www.founder.com.cn/cn/bTheORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.476536239.0000000002C11000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.com/designers?ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                		high
                                http://www.tiro.comEnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designersEnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                  		high
                                  http://www.goodfont.co.krORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.carterandcone.comlORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.sajatypeworks.comORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.typography.netDORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.com/designers/cabarga.htmlNORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                    		high
                                    http://www.founder.com.cn/cn/cTheORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.galapagosdesign.com/staff/dennis.htmORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://fontfabrik.comORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.founder.com.cn/cnORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.com/designers/frere-jones.htmlORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                      		high
                                      http://yFwcGw.comORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.476536239.0000000002C11000.00000004.00000001.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.jiyu-kobo.co.jp/ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.galapagosdesign.com/DPleaseORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.com/designers8ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                        		high
                                        http://www.fonts.comORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                          		high
                                          http://www.sandoll.co.krORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.urwpp.deDPleaseORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.zhongyicts.com.cnORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.sakkal.comORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.380642858.0000000005980000.00000002.00000001.sdmp, EnhancementRadio.exe, 00000018.00000002.485180258.0000000005A00000.00000002.00000001.sdmp, EnhancementRadio.exe, 0000001A.00000002.485005111.0000000005A80000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000001.00000002.378683076.0000000003B78000.00000004.00000001.sdmp, ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe, 00000017.00000002.471689095.0000000000402000.00000040.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown

                                          Contacted IPs

                                          No contacted IP infos

                                          General Information

                                          Joe Sandbox Version:33.0.0 White Diamond
                                          Analysis ID:458887
                                          Start date:03.08.2021
                                          Start time:20:42:33
                                          Joe Sandbox Product:CloudBasic
                                          Overall analysis duration:0h 12m 36s
                                          Hypervisor based Inspection enabled:false
                                          Report type:light
                                          Sample file name:ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                                          Cookbook file name:default.jbs
                                          Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                          Number of analysed new started processes analysed:29
                                          Number of new started drivers analysed:0
                                          Number of existing processes analysed:0
                                          Number of existing drivers analysed:0
                                          Number of injected processes analysed:0
                                          Technologies:
                                          • HCA enabled
                                          • EGA enabled
                                          • HDC enabled
                                          • AMSI enabled
                                          Analysis Mode:default
                                          Analysis stop reason:Timeout
                                          Detection:MAL
                                          Classification:mal100.troj.evad.winEXE@5/5@0/0
                                          EGA Information:Failed
                                          HDC Information:Failed
                                          HCA Information:
                                          • Successful, ratio: 95%
                                          • Number of executed functions: 0
                                          • Number of non-executed functions: 0
                                          Cookbook Comments:
                                          • Adjust boot time
                                          • Enable AMSI
                                          • Found application associated with file extension: .exe
                                          Warnings:
                                          Show All
                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
                                          • Not all processes where analyzed, report is missing behavior information
                                          • Report creation exceeded maximum time and may have missing disassembly code information.
                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                          • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.

                                          Simulations

                                          Behavior and APIs

                                          TimeTypeDescription
                                          20:44:42AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run EnhancementRadio "C:\Users\user\AppData\Local\EnhancementRadio.exe"
                                          20:44:50AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run EnhancementRadio "C:\Users\user\AppData\Local\EnhancementRadio.exe"
                                          20:44:51API Interceptor267x Sleep call for process: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe modified

                                          Joe Sandbox View / Context

                                          IPs

                                          No context

                                          Domains

                                          No context

                                          ASN

                                          No context

                                          JA3 Fingerprints

                                          No context

                                          Dropped Files

                                          No context

                                          Created / dropped Files

                                          C:\Users\user\AppData\Local\EnhancementRadio.exe
                                          Process:C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                                          File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                          Category:dropped
                                          Size (bytes):584704
                                          Entropy (8bit):6.428997462356413
                                          Encrypted:false
                                          SSDEEP:12288:jb4ltZl87PVptm3TE8cCbUCOF1gJ3ntYJZ1iDwfUR8K:jbytZmBAbu1S9YJZJc
                                          MD5:4EB106D21C787C7B4215721673E15B39
                                          SHA1:2600E6B0EA8E3D39D4001ED0F8A35A87FC716566
                                          SHA-256:9FCDD20C1848723A889FD4EBB88E52A2CB9FAE8EC9E8CFE70D8E9706EF3E8992
                                          SHA-512:69BF8422C1102C6EE99139CB80070E0955D6B192DE831A577AE308A2460D5A52E975C358CA275A5E0015293A98ABA341BD7249842C073A911D34168B1B864A69
                                          Malicious:true
                                          Antivirus:
                                          • Antivirus: Joe Sandbox ML, Detection: 100%
                                          • Antivirus: Metadefender, Detection: 46%, Browse
                                          • Antivirus: ReversingLabs, Detection: 61%
                                          Reputation:low
                                          Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..n...|........... ........@.. .......................@............@.....................................K........x................... ....................................................... ............... ..H............text...4m... ...n.................. ..`.rsrc....x.......z...p..............@..@.reloc....... ......................@..B........................H....... 4..8,..........X`...,..........................................^.(....8.....(....8....*r.(....8....*.{....o....8........0..........8}.......E....x...8s....{....o....s....%..(....(....o....&8....*...X..8.... ....(....8.....{....o....s....%..(....o....o....&8h......8V...8u...8........?z...8!..........s....s....%o....o....8|...... ....~"...94...& ....8)...8....8-... ....(....8G......X..8........?M...8.......0..........8....(......o....*(......o......8.....{....(.....o..
                                          C:\Users\user\AppData\Local\EnhancementRadio.exe:Zone.Identifier
                                          Process:C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):26
                                          Entropy (8bit):3.95006375643621
                                          Encrypted:false
                                          SSDEEP:3:ggPYV:rPYV
                                          MD5:187F488E27DB4AF347237FE461A079AD
                                          SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                          SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                          SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                          Malicious:true
                                          Reputation:high, very likely benign file
                                          Preview: [ZoneTransfer]....ZoneId=0
                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe.log
                                          Process:C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:modified
                                          Size (bytes):1119
                                          Entropy (8bit):5.356708753875314
                                          Encrypted:false
                                          SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzd
                                          MD5:3197B1D4714B56F2A6AC9E83761739AE
                                          SHA1:3B38010F0DF51C1D4D2C020138202DABB686741D
                                          SHA-256:40586572180B85042FEFED9F367B43831C5D269751D9F3940BBC29B41E18E9F6
                                          SHA-512:58EC975A53AD9B19B425F6C6843A94CC280F794D436BBF3D29D8B76CA1E8C2D8883B3E754F9D4F2C9E9387FE88825CCD9919369A5446B1AFF73EDBE07FA94D88
                                          Malicious:true
                                          Reputation:moderate, very likely benign file
                                          Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21
                                          C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                                          Process:C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                                          File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                          Category:dropped
                                          Size (bytes):584704
                                          Entropy (8bit):6.428997462356413
                                          Encrypted:false
                                          SSDEEP:12288:jb4ltZl87PVptm3TE8cCbUCOF1gJ3ntYJZ1iDwfUR8K:jbytZmBAbu1S9YJZJc
                                          MD5:4EB106D21C787C7B4215721673E15B39
                                          SHA1:2600E6B0EA8E3D39D4001ED0F8A35A87FC716566
                                          SHA-256:9FCDD20C1848723A889FD4EBB88E52A2CB9FAE8EC9E8CFE70D8E9706EF3E8992
                                          SHA-512:69BF8422C1102C6EE99139CB80070E0955D6B192DE831A577AE308A2460D5A52E975C358CA275A5E0015293A98ABA341BD7249842C073A911D34168B1B864A69
                                          Malicious:true
                                          Antivirus:
                                          • Antivirus: Joe Sandbox ML, Detection: 100%
                                          • Antivirus: Metadefender, Detection: 46%, Browse
                                          • Antivirus: ReversingLabs, Detection: 61%
                                          Reputation:low
                                          Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..n...|........... ........@.. .......................@............@.....................................K........x................... ....................................................... ............... ..H............text...4m... ...n.................. ..`.rsrc....x.......z...p..............@..@.reloc....... ......................@..B........................H....... 4..8,..........X`...,..........................................^.(....8.....(....8....*r.(....8....*.{....o....8........0..........8}.......E....x...8s....{....o....s....%..(....(....o....&8....*...X..8.... ....(....8.....{....o....s....%..(....o....o....&8h......8V...8u...8........?z...8!..........s....s....%o....o....8|...... ....~"...94...& ....8)...8....8-... ....(....8G......X..8........?M...8.......0..........8....(......o....*(......o......8.....{....(.....o..
                                          C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe:Zone.Identifier
                                          Process:C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):26
                                          Entropy (8bit):3.95006375643621
                                          Encrypted:false
                                          SSDEEP:3:ggPYV:rPYV
                                          MD5:187F488E27DB4AF347237FE461A079AD
                                          SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                          SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                          SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                          Malicious:true
                                          Reputation:high, very likely benign file
                                          Preview: [ZoneTransfer]....ZoneId=0

                                          Static File Info

                                          General

                                          File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                          Entropy (8bit):6.428997462356413
                                          TrID:
                                          • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                          • Win32 Executable (generic) a (10002005/4) 49.75%
                                          • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                          • Windows Screen Saver (13104/52) 0.07%
                                          • Generic Win/DOS Executable (2004/3) 0.01%
                                          File name:ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                                          File size:584704
                                          MD5:4eb106d21c787c7b4215721673e15b39
                                          SHA1:2600e6b0ea8e3d39d4001ed0f8a35a87fc716566
                                          SHA256:9fcdd20c1848723a889fd4ebb88e52a2cb9fae8ec9e8cfe70d8e9706ef3e8992
                                          SHA512:69bf8422c1102c6ee99139cb80070e0955d6b192de831a577ae308a2460d5a52e975c358ca275a5e0015293a98aba341bd7249842c073a911d34168b1b864a69
                                          SSDEEP:12288:jb4ltZl87PVptm3TE8cCbUCOF1gJ3ntYJZ1iDwfUR8K:jbytZmBAbu1S9YJZJc
                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..n...|........... ........@.. .......................@............@................................

                                          File Icon

                                          Icon Hash:60d8c8c9c9e9c1c8

                                          Static PE Info

                                          General

                                          Entrypoint:0x488d2e
                                          Entrypoint Section:.text
                                          Digitally signed:false
                                          Imagebase:0x400000
                                          Subsystem:windows gui
                                          Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                                          DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                          Time Stamp:0xB5F6BF93 [Mon Sep 27 21:03:15 2066 UTC]
                                          TLS Callbacks:
                                          CLR (.Net) Version:v4.0.30319
                                          OS Version Major:4
                                          OS Version Minor:0
                                          File Version Major:4
                                          File Version Minor:0
                                          Subsystem Version Major:4
                                          Subsystem Version Minor:0
                                          Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                          Entrypoint Preview

                                          Instruction
                                          jmp dword ptr [00402000h]
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al

                                          Data Directories

                                          NameVirtual AddressVirtual Size Is in Section
                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x88ce00x4b.text
                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x8a0000x78a4.rsrc
                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x920000xc.reloc
                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                          Sections

                                          NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                          .text0x20000x86d340x86e00False0.70304716462data6.18965039171IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                          .rsrc0x8a0000x78a40x7a00False0.887102971311data7.74086473521IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                          .reloc0x920000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                          Resources

                                          NameRVASizeTypeLanguageCountry
                                          RT_ICON0x8a1300x64a9PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                          RT_GROUP_ICON0x905dc0x14data
                                          RT_VERSION0x905f00x56cdata
                                          RT_MANIFEST0x90b5c0xd48XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                          Imports

                                          DLLImport
                                          mscoree.dll_CorExeMain

                                          Version Infos

                                          DescriptionData
                                          Translation0x0000 0x04b0
                                          LegalCopyright
                                          Assembly Version0.0.0.0
                                          InternalNameown.exe
                                          FileVersion0.0.0.0
                                          CompanyNameRaimersoft
                                          LegalTrademarks
                                          CommentsTapinRadio Setup
                                          ProductNameTapinRadio
                                          ProductVersion0.0.0.0
                                          FileDescriptionTapinRadio Setup
                                          OriginalFilenameown.exe

                                          Network Behavior

                                          No network behavior found

                                          Code Manipulations

                                          Statistics

                                          Behavior

                                          Click to jump to process

                                          System Behavior

                                          Analysis Process: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe PID: 5748 Parent PID: 5644

                                          General

                                          Start time:20:43:22
                                          Start date:03/08/2021
                                          Path:C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                                          Wow64 process (32bit):true
                                          Commandline:'C:\Users\user\Desktop\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe'
                                          Imagebase:0x630000
                                          File size:584704 bytes
                                          MD5 hash:4EB106D21C787C7B4215721673E15B39
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:.Net C# or VB.NET
                                          Yara matches:
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.378683076.0000000003B78000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.378683076.0000000003B78000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.378760193.0000000003C07000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.378760193.0000000003C07000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.378128189.0000000003A31000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.378128189.0000000003A31000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.375822190.0000000002B18000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.375822190.0000000002B18000.00000004.00000001.sdmp, Author: Joe Security
                                          Reputation:low

                                          Analysis Process: ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe PID: 7008 Parent PID: 5748

                                          General

                                          Start time:20:44:40
                                          Start date:03/08/2021
                                          Path:C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                                          Wow64 process (32bit):true
                                          Commandline:C:\Users\user\AppData\Local\Temp\ORDER#142155312938 KALISKAYA WODKA CON1GQDP- URGENT-New.exe
                                          Imagebase:0x7f0000
                                          File size:584704 bytes
                                          MD5 hash:4EB106D21C787C7B4215721673E15B39
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:.Net C# or VB.NET
                                          Yara matches:
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000017.00000002.471689095.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000017.00000002.471689095.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000002.476536239.0000000002C11000.00000004.00000001.sdmp, Author: Joe Security
                                          Antivirus matches:
                                          • Detection: 100%, Joe Sandbox ML
                                          • Detection: 46%, Metadefender, Browse
                                          • Detection: 61%, ReversingLabs
                                          Reputation:low

                                          Analysis Process: EnhancementRadio.exe PID: 7104 Parent PID: 3388

                                          General

                                          Start time:20:44:50
                                          Start date:03/08/2021
                                          Path:C:\Users\user\AppData\Local\EnhancementRadio.exe
                                          Wow64 process (32bit):true
                                          Commandline:'C:\Users\user\AppData\Local\EnhancementRadio.exe'
                                          Imagebase:0x660000
                                          File size:584704 bytes
                                          MD5 hash:4EB106D21C787C7B4215721673E15B39
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:.Net C# or VB.NET
                                          Antivirus matches:
                                          • Detection: 100%, Joe Sandbox ML
                                          • Detection: 46%, Metadefender, Browse
                                          • Detection: 61%, ReversingLabs
                                          Reputation:low

                                          Analysis Process: EnhancementRadio.exe PID: 4308 Parent PID: 3388

                                          General

                                          Start time:20:44:59
                                          Start date:03/08/2021
                                          Path:C:\Users\user\AppData\Local\EnhancementRadio.exe
                                          Wow64 process (32bit):true
                                          Commandline:'C:\Users\user\AppData\Local\EnhancementRadio.exe'
                                          Imagebase:0x550000
                                          File size:584704 bytes
                                          MD5 hash:4EB106D21C787C7B4215721673E15B39
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:.Net C# or VB.NET
                                          Reputation:low

                                          Disassembly

                                          Code Analysis

                                          Reset < >