Windows Analysis Report
New Order.exe

Overview

General Information

Sample Name: New Order.exe
Analysis ID: 626210
MD5: faa827279f0932969adb995b977f2a1e
SHA1: 9f836961f492cb7083f29a0c9180c27a7ea406e2
SHA256: 4ff77f4e72dd52708b1612318b205be3c750b6f6956363b6055b524bd89cf3fb
Tags: exe
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Yara detected AntiVM3
Tries to steal Mail credentials (via file / registry access)
Initial sample is a PE file and has a suspicious name
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Injects a PE file into a foreign processes
Yara detected Generic Downloader
.NET source code contains very large array initializations
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Found malware configuration
Source: 4.2.New Order.exe.400000.0.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "FTP Host": "ftp://ftp.navetesilazi.ro/", "Username": "sunny@navetesilazi.ro", "Password": "u,S2gsd@*K7C"}
Multi AV Scanner detection for submitted file
Source: New Order.exe Virustotal: Detection: 37% Perma Link
Source: New Order.exe ReversingLabs: Detection: 31%
Machine Learning detection for sample
Source: New Order.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 4.2.New Order.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 4.0.New Order.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 4.0.New Order.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 4.0.New Order.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 4.0.New Order.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8
Source: 4.0.New Order.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Uses 32bit PE files
Source: New Order.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: New Order.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\New Order.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_06A6D530

Networking
barindex
Yara detected Generic Downloader
Source: Yara match File source: 4.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.New Order.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.New Order.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.New Order.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.New Order.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.New Order.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.New Order.exe.3606cd0.3.raw.unpack, type: UNPACKEDPE
Source: New Order.exe, 00000004.00000002.521456203.00000000029D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ftp://ftp.navetesilazi.ro/sunny
Source: New Order.exe, 00000004.00000002.521456203.00000000029D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: New Order.exe, 00000004.00000002.521456203.00000000029D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: New Order.exe, 00000004.00000002.521962296.0000000002D30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.255603989.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: New Order.exe, 00000000.00000003.260043589.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.263069055.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261800272.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262150037.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260403237.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.259679585.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260675550.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.259189127.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262944790.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262074018.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262794568.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261536074.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260575464.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262733473.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261242239.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261707286.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261734967.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261615691.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.264325169.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261008326.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261594663.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: New Order.exe, 00000000.00000003.260043589.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.263069055.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261800272.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262150037.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260403237.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.259679585.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260675550.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.259189127.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262944790.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262074018.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262794568.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261536074.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260575464.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262733473.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261242239.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261707286.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261734967.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261615691.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.264325169.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261008326.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261594663.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html6
Source: New Order.exe, 00000000.00000003.256313284.00000000053B3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: New Order.exe, 00000000.00000003.261800272.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262150037.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260403237.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262074018.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261536074.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261242239.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261615691.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261008326.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261594663.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261468260.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261962697.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260373768.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261363692.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261487868.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260315925.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262215325.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261947858.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262371935.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261329710.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262129266.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: New Order.exe, 00000000.00000003.262150037.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262074018.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262215325.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262371935.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262129266.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262402257.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262187348.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262168734.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262236657.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262261834.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com.TTF
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: New Order.exe, 00000000.00000003.261707286.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261719581.00000000053FC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlX
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: New Order.exe, 00000000.00000003.261363692.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261343363.00000000053FC000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261329710.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261402977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmlht
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: New Order.exe, 00000000.00000003.261536074.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261242239.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261615691.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261008326.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261594663.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261468260.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261363692.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261487868.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261329710.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261504574.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261054840.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261573979.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261195291.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260945047.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261520264.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261402977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261265180.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261310707.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261284495.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comF
Source: New Order.exe, 00000000.00000003.262150037.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262074018.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262215325.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262371935.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262129266.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261982834.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262402257.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262187348.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262168734.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261997015.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262236657.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262261834.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comG
Source: New Order.exe, 00000000.00000003.262150037.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262074018.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262215325.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262371935.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262129266.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261982834.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262402257.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262187348.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262168734.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261997015.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262236657.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262261834.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comI.TTF
Source: New Order.exe, 00000000.00000003.267297280.00000000053F5000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.267127411.00000000053F5000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.294277019.00000000053F5000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.267151398.00000000053F5000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.267521568.00000000053F5000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.267112661.00000000053F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: New Order.exe, 00000000.00000003.261800272.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262150037.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262074018.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261536074.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261707286.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261734967.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261615691.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261594663.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261468260.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261962697.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261363692.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261487868.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262215325.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261947858.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262371935.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262129266.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261504574.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261776381.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261573979.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261750999.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261982834.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comaN
Source: New Order.exe, 00000000.00000003.260315925.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comdQ
Source: New Order.exe, 00000000.00000003.261536074.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261468260.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261363692.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261487868.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261329710.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261504574.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261520264.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261402977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comdb
Source: New Order.exe, 00000000.00000003.261800272.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262150037.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262074018.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261962697.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262215325.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261947858.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262371935.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262129266.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261982834.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262402257.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261911453.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262187348.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262168734.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261997015.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262236657.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262261834.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261838549.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261930191.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262477906.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262431790.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comdi
Source: New Order.exe, 00000000.00000003.261242239.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261008326.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260864090.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261329710.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261054840.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261195291.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260945047.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261265180.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260920245.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261310707.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261284495.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comdt
Source: New Order.exe, 00000000.00000003.261242239.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261008326.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261054840.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261195291.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260945047.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261265180.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261310707.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261284495.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comessedb
Source: New Order.exe, 00000000.00000003.261536074.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261707286.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261734967.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261615691.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261594663.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261468260.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261363692.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261487868.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261329710.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261504574.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261776381.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261573979.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261750999.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261690313.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261520264.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261402977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261670238.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comessedi
Source: New Order.exe, 00000000.00000003.260403237.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260535172.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comld
Source: New Order.exe, 00000000.00000003.267127411.00000000053F5000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.267151398.00000000053F5000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.267112661.00000000053F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comldvP
Source: New Order.exe, 00000000.00000003.261707286.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comlic
Source: New Order.exe, 00000000.00000003.261536074.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261242239.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261008326.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261468260.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261363692.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261487868.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261329710.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261504574.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261054840.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261195291.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260945047.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261520264.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261402977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261265180.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260920245.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261310707.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261284495.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comoitu
Source: New Order.exe, 00000000.00000003.261536074.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261242239.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261707286.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261615691.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261008326.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261594663.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260864090.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261468260.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261363692.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261487868.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261329710.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261504574.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261054840.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261573979.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261195291.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260945047.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261690313.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261520264.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261402977.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261265180.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260920245.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comony
Source: New Order.exe, 00000000.00000003.267297280.00000000053F5000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.267127411.00000000053F5000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.294277019.00000000053F5000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.267151398.00000000053F5000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.267521568.00000000053F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comrsiva
Source: New Order.exe, 00000000.00000003.261800272.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262150037.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262074018.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261962697.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262215325.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261947858.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262371935.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262129266.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261776381.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261982834.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262402257.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261911453.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262187348.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262168734.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261997015.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262236657.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262261834.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261838549.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.261930191.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262477906.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.262431790.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comtuta
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: New Order.exe, 00000000.00000003.254695939.00000000053EA000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.254580619.00000000053E9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: New Order.exe, 00000000.00000003.255367660.00000000053F0000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.255219858.00000000053F0000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.255017818.00000000053EF000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.255127554.00000000053E9000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.255187356.00000000053EF000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.255151097.00000000053ED000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.254970898.00000000053EF000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.255136855.00000000053EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/L;;
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: New Order.exe, 00000000.00000003.254695939.00000000053EA000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.254580619.00000000053E9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnt
Source: New Order.exe, 00000000.00000003.263291014.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: New Order.exe, 00000000.00000003.263269630.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.263528813.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.263370715.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.263353480.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.263502565.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.263983826.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.263291014.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: New Order.exe, 00000000.00000003.257483589.00000000053F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: New Order.exe, 00000000.00000003.256813993.00000000053E9000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.256855458.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.256943522.00000000053E9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/#
Source: New Order.exe, 00000000.00000003.257696041.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.258296537.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257978806.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257924602.00000000053F0000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.258046006.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257543837.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257483589.00000000053F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/2
Source: New Order.exe, 00000000.00000003.257146126.00000000053E9000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257696041.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.258296537.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257978806.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257924602.00000000053F0000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257263804.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.258046006.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257543837.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257483589.00000000053F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/4
Source: New Order.exe, 00000000.00000003.257146126.00000000053E9000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257696041.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257978806.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257924602.00000000053F0000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257263804.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.258046006.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257046797.00000000053E9000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.256943522.00000000053E9000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257543837.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257483589.00000000053F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/G
Source: New Order.exe, 00000000.00000003.257696041.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257978806.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257924602.00000000053F0000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.258046006.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257543837.00000000053F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Gras
Source: New Order.exe, 00000000.00000003.257146126.00000000053E9000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257696041.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257978806.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257924602.00000000053F0000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257263804.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.258046006.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257046797.00000000053E9000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257543837.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257483589.00000000053F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/N
Source: New Order.exe, 00000000.00000003.257978806.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257924602.00000000053F0000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.258046006.00000000053EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/P
Source: New Order.exe, 00000000.00000003.257146126.00000000053E9000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257696041.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257978806.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257924602.00000000053F0000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257263804.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.258046006.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257046797.00000000053E9000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257543837.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257483589.00000000053F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: New Order.exe, 00000000.00000003.257543837.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.259597195.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260131394.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.259941673.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257483589.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.259443452.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.258929215.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.259855092.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.260100966.00000000053F3000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.259361235.00000000053F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: New Order.exe, 00000000.00000003.257146126.00000000053E9000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257696041.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257978806.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257924602.00000000053F0000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257263804.00000000053EB000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.258046006.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257046797.00000000053E9000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257543837.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257483589.00000000053F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/t
Source: New Order.exe, 00000000.00000003.257978806.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257924602.00000000053F0000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.258046006.00000000053EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/ue
Source: New Order.exe, 00000000.00000003.257696041.00000000053F2000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257978806.00000000053EE000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.257924602.00000000053F0000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000003.258046006.00000000053EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/wa
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: New Order.exe, 00000000.00000003.255250488.00000000053BE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.
Source: New Order.exe, 00000000.00000003.255146264.00000000053EA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: New Order.exe, 00000000.00000003.254052864.00000000053C5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com;
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: New Order.exe, 00000000.00000002.301860506.0000000006642000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: New Order.exe, 00000004.00000002.521456203.00000000029D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ySmlPP.com
Source: New Order.exe, 00000004.00000002.521456203.00000000029D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gp8eppjNNQTPw.net
Source: New Order.exe, 00000004.00000003.502947482.0000000000CC4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gp8eppjNNQTPw.net853321935-2125563209-4053062332-1002_Classes
Source: New Order.exe, 00000000.00000002.298887082.00000000034BF000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000004.00000000.292255451.0000000000402000.00000040.00000400.00020000.00000000.sdmp, New Order.exe, 00000004.00000000.290944064.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: New Order.exe, 00000004.00000002.521456203.00000000029D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Creates a DirectInput object (often for capturing keystrokes)
Source: New Order.exe, 00000000.00000002.295210516.000000000080A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.New Order.exe.3606cd0.3.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.New Order.exe.24e4ef8.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 4.0.New Order.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.New Order.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.New Order.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.New Order.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.New Order.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.New Order.exe.3606cd0.3.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 00000004.00000002.521456203.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: Process Memory Space: New Order.exe PID: 6868, type: MEMORYSTR Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: New Order.exe
.NET source code contains very large array initializations
Source: 4.2.New Order.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b04ABEA9Cu002dD42Du002d49B5u002dA531u002d8B2C266481EEu007d/u00373E4875Au002d7B70u002d4F11u002dBD68u002d29AE886A5E85.cs Large array initialization: .cctor: array initializer size 11948
Source: 4.0.New Order.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007b04ABEA9Cu002dD42Du002d49B5u002dA531u002d8B2C266481EEu007d/u00373E4875Au002d7B70u002d4F11u002dBD68u002d29AE886A5E85.cs Large array initialization: .cctor: array initializer size 11948
Source: 4.0.New Order.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007b04ABEA9Cu002dD42Du002d49B5u002dA531u002d8B2C266481EEu007d/u00373E4875Au002d7B70u002d4F11u002dBD68u002d29AE886A5E85.cs Large array initialization: .cctor: array initializer size 11948
Source: 4.0.New Order.exe.400000.6.unpack, u003cPrivateImplementationDetailsu003eu007b04ABEA9Cu002dD42Du002d49B5u002dA531u002d8B2C266481EEu007d/u00373E4875Au002d7B70u002d4F11u002dBD68u002d29AE886A5E85.cs Large array initialization: .cctor: array initializer size 11948
Uses 32bit PE files
Source: New Order.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 0.2.New Order.exe.3606cd0.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.New Order.exe.24e4ef8.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 4.0.New Order.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.New Order.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.New Order.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.New Order.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.New Order.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.New Order.exe.3606cd0.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 00000004.00000002.521456203.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: Process Memory Space: New Order.exe PID: 6868, type: MEMORYSTR Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Detected potential crypto function
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_0246E570 0_2_0246E570
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_0246E580 0_2_0246E580
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_0246BCF4 0_2_0246BCF4
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A69618 0_2_06A69618
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A65658 0_2_06A65658
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A62250 0_2_06A62250
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A66B28 0_2_06A66B28
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A69898 0_2_06A69898
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A69617 0_2_06A69617
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A6AE60 0_2_06A6AE60
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A65648 0_2_06A65648
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A62DB8 0_2_06A62DB8
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A61DE0 0_2_06A61DE0
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A61DD0 0_2_06A61DD0
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A6750B 0_2_06A6750B
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A69AEA 0_2_06A69AEA
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A6722F 0_2_06A6722F
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A67230 0_2_06A67230
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A66200 0_2_06A66200
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A60A68 0_2_06A60A68
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A62248 0_2_06A62248
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A60A58 0_2_06A60A58
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A61B87 0_2_06A61B87
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A61B88 0_2_06A61B88
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A69323 0_2_06A69323
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A69330 0_2_06A69330
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A69B03 0_2_06A69B03
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A66B18 0_2_06A66B18
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A69B61 0_2_06A69B61
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A69B45 0_2_06A69B45
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A6988B 0_2_06A6988B
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A61808 0_2_06A61808
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A61818 0_2_06A61818
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A6206F 0_2_06A6206F
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A62070 0_2_06A62070
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A661F8 0_2_06A661F8
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A671CC 0_2_06A671CC
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_00062050 0_2_00062050
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_00C9C0A0 4_2_00C9C0A0
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_00C92020 4_2_00C92020
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_00C92D50 4_2_00C92D50
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_00C92768 4_2_00C92768
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_00C9F308 4_2_00C9F308
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_00C9B920 4_2_00C9B920
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_00E50040 4_2_00E50040
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_00E52308 4_2_00E52308
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_00E59460 4_2_00E59460
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_00E55EAC 4_2_00E55EAC
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_00E5EFC8 4_2_00E5EFC8
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_00E5003D 4_2_00E5003D
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_00E543E0 4_2_00E543E0
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_00632050 4_2_00632050
Sample file is different than original file name gathered from version info
Source: New Order.exe Binary or memory string: OriginalFilename vs New Order.exe
Source: New Order.exe, 00000000.00000002.298887082.00000000034BF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTPojXuVgRwvTuslAVhGVJFKrC.exe4 vs New Order.exe
Source: New Order.exe, 00000000.00000002.298887082.00000000034BF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs New Order.exe
Source: New Order.exe, 00000000.00000002.295210516.000000000080A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs New Order.exe
Source: New Order.exe, 00000000.00000002.297102320.00000000024A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs New Order.exe
Source: New Order.exe, 00000000.00000002.297102320.00000000024A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTPojXuVgRwvTuslAVhGVJFKrC.exe4 vs New Order.exe
Source: New Order.exe, 00000000.00000003.280367821.0000000002AF2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs New Order.exe
Source: New Order.exe, 00000000.00000002.302500433.0000000006E20000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs New Order.exe
Source: New Order.exe Binary or memory string: OriginalFilename vs New Order.exe
Source: New Order.exe, 00000004.00000000.292255451.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTPojXuVgRwvTuslAVhGVJFKrC.exe4 vs New Order.exe
Source: New Order.exe, 00000004.00000002.520356033.0000000000AF8000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs New Order.exe
Source: New Order.exe Binary or memory string: OriginalFilenameBHMCc.exe8 vs New Order.exe
Source: New Order.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: New Order.exe Virustotal: Detection: 37%
Source: New Order.exe ReversingLabs: Detection: 31%
Source: New Order.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\New Order.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\New Order.exe "C:\Users\user\Desktop\New Order.exe"
Source: C:\Users\user\Desktop\New Order.exe Process created: C:\Users\user\Desktop\New Order.exe {path}
Source: C:\Users\user\Desktop\New Order.exe Process created: C:\Users\user\Desktop\New Order.exe {path} Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\New Order.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\New Order.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New Order.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/1@0/0
Source: C:\Users\user\Desktop\New Order.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: 4.2.New Order.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.New Order.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.New Order.exe.400000.12.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.New Order.exe.400000.12.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.New Order.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.New Order.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\New Order.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: New Order.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: New Order.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_000676A7 push es; retf 0_2_000676BE
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_000676BF push es; retf 0_2_000676D6
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A67B27 push es; retf A679h 0_2_06A67B40
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A6536D push es; ret 0_2_06A65380
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A640E0 push edi; iretd 0_2_06A640E3
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A640D6 push edi; iretd 0_2_06A640D9
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A66847 push es; retf 0_2_06A66850
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A61190 push esp; iretd 0_2_06A61191
Source: C:\Users\user\Desktop\New Order.exe Code function: 0_2_06A69153 push es; retf 0_2_06A69154
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_006376A7 push es; retf 4_2_006376BE
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_006376BF push es; retf 4_2_006376D6
Source: C:\Users\user\Desktop\New Order.exe Code function: 4_2_00C97A37 push edi; retn 0000h 4_2_00C97A39
Source: initial sample Static PE information: section name: .text entropy: 7.85321118232
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: New Order.exe PID: 6468, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: New Order.exe, 00000000.00000002.298637921.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000002.297102320.00000000024A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: New Order.exe, 00000000.00000002.298637921.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, New Order.exe, 00000000.00000002.297102320.00000000024A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\New Order.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\New Order.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\New Order.exe TID: 6488 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe TID: 6252 Thread sleep count: 37 > 30 Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe TID: 6252 Thread sleep time: -34126476536362649s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe TID: 6292 Thread sleep count: 5029 > 30 Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe TID: 6292 Thread sleep count: 4780 > 30 Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\New Order.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\New Order.exe Window / User API: threadDelayed 5029 Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Window / User API: threadDelayed 4780 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\New Order.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\New Order.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\New Order.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: New Order.exe, 00000000.00000002.297102320.00000000024A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: New Order.exe, 00000000.00000002.297102320.00000000024A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: New Order.exe, 00000000.00000002.297102320.00000000024A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: New Order.exe, 00000000.00000002.297102320.00000000024A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: New Order.exe, 00000000.00000002.297102320.00000000024A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE
Source: New Order.exe, 00000000.00000002.297102320.00000000024A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: New Order.exe, 00000000.00000002.297102320.00000000024A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: New Order.exe, 00000000.00000002.297102320.00000000024A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: New Order.exe, 00000000.00000002.297102320.00000000024A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Enables debug privileges
Source: C:\Users\user\Desktop\New Order.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\New Order.exe Memory written: C:\Users\user\Desktop\New Order.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\New Order.exe Process created: C:\Users\user\Desktop\New Order.exe {path} Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Users\user\Desktop\New Order.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Users\user\Desktop\New Order.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.New Order.exe.3606cd0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.New Order.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.New Order.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.New Order.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.New Order.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.New Order.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.New Order.exe.3606cd0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000000.292255451.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.519247653.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.290944064.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.292766510.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.291441736.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.298887082.00000000034BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.521456203.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: New Order.exe PID: 6468, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: New Order.exe PID: 6868, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\New Order.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\New Order.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\New Order.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\New Order.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\New Order.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000004.00000002.521456203.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: New Order.exe PID: 6868, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.New Order.exe.3606cd0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.New Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.New Order.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.New Order.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.New Order.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.New Order.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.0.New Order.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.New Order.exe.3606cd0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000000.292255451.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.519247653.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.290944064.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.292766510.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.291441736.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.298887082.00000000034BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.521456203.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: New Order.exe PID: 6468, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: New Order.exe PID: 6868, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 626210 Sample: New Order.exe Startdate: 13/05/2022 Architecture: WINDOWS Score: 100 15 Found malware configuration 2->15 17 Malicious sample detected (through community Yara rule) 2->17 19 Multi AV Scanner detection for submitted file 2->19 21 9 other signatures 2->21 6 New Order.exe 3 2->6         started        process3 file4 13 C:\Users\user\AppData\...13ew Order.exe.log, ASCII 6->13 dropped 23 Injects a PE file into a foreign processes 6->23 10 New Order.exe 15 2 6->10         started        signatures5 process6 signatures7 25 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->25 27 Tries to steal Mail credentials (via file / registry access) 10->27 29 Tries to harvest and steal ftp login credentials 10->29 31 Tries to harvest and steal browser information (history, passwords, etc) 10->31
⊘No contacted IP infos