Loading ...

Play interactive tourEdit tour

Analysis Report Purchase Order.gz.exe

Overview

General Information

Sample Name:Purchase Order.gz.exe
Analysis ID:289500
MD5:8328b272fa635e228d84d756639cb09a
SHA1:cd36f97b5518ee974fec8061d0f2a1a5d6aebdd8
SHA256:e03c4f9c8ae0b28a7538315c3af97428339911bd6118371c0459adfd14abca44
Tags:exe

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AgentTesla
Yara detected AntiVM_3
.NET source code contains method to dynamically call methods (often used by packers)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "roCMZOI2VuNq2qw", "URL: ": "http://pLhkMTVj6DlFExpkl.com", "To: ": "bdconsignment@unsecuritypeacekingkeeping.us", "ByHost: ": "mail.swedish-hospital.com:587", "Password: ": "MdAse6", "From: ": "info@swedish-hospital.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.444658237.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000002.00000002.449347189.0000000002DA5000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000002.00000002.449347189.0000000002DA5000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        00000000.00000002.208494696.0000000004299000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000000.00000002.208892123.0000000004529000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 5 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            2.2.Purchase Order.gz.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview

              No Sigma rule has matched

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Found malware configurationShow sources
              Source: Purchase Order.gz.exe.3168.2.memstrMalware Configuration Extractor: Agenttesla {"Username: ": "roCMZOI2VuNq2qw", "URL: ": "http://pLhkMTVj6DlFExpkl.com", "To: ": "bdconsignment@unsecuritypeacekingkeeping.us", "ByHost: ": "mail.swedish-hospital.com:587", "Password: ": "MdAse6", "From: ": "info@swedish-hospital.com"}
              Multi AV Scanner detection for submitted fileShow sources
              Source: Purchase Order.gz.exeVirustotal: Detection: 40%Perma Link
              Source: Purchase Order.gz.exeReversingLabs: Detection: 43%
              Machine Learning detection for sampleShow sources
              Source: Purchase Order.gz.exeJoe Sandbox ML: detected
              Source: 2.2.Purchase Order.gz.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8

              Networking:

              barindex
              Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
              Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.6:49754 -> 93.188.3.11:587
              May check the online IP address of the machineShow sources
              Source: unknownDNS query: name: api.ipify.org
              Source: unknownDNS query: name: api.ipify.org
              Source: unknownDNS query: name: api.ipify.org
              Source: unknownDNS query: name: api.ipify.org
              Source: unknownDNS query: name: api.ipify.org
              Source: unknownDNS query: name: api.ipify.org
              Source: global trafficTCP traffic: 192.168.2.6:49754 -> 93.188.3.11:587
              Source: Joe Sandbox ViewIP Address: 184.73.247.141 184.73.247.141
              Source: Joe Sandbox ViewIP Address: 184.73.247.141 184.73.247.141
              Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
              Source: global trafficTCP traffic: 192.168.2.6:49754 -> 93.188.3.11:587
              Source: unknownDNS traffic detected: queries for: api.ipify.org
              Source: Purchase Order.gz.exe, 00000002.00000002.449056486.0000000002D51000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
              Source: Purchase Order.gz.exe, 00000002.00000002.449056486.0000000002D51000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
              Source: Purchase Order.gz.exe, 00000002.00000002.447457945.0000000001186000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
              Source: Purchase Order.gz.exe, 00000002.00000002.447457945.0000000001186000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl0
              Source: Purchase Order.gz.exe, 00000002.00000002.449056486.0000000002D51000.00000004.00000001.sdmpString found in binary or memory: http://dMOxEx.com
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
              Source: Purchase Order.gz.exe, 00000002.00000002.455645909.0000000002FD7000.00000004.00000001.sdmpString found in binary or memory: http://mail.swedish-hospital.com
              Source: Purchase Order.gz.exe, 00000002.00000002.455645909.0000000002FD7000.00000004.00000001.sdmpString found in binary or memory: http://mailcluster.loopia.se
              Source: Purchase Order.gz.exe, 00000002.00000002.447457945.0000000001186000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.comodoca.com0
              Source: Purchase Order.gz.exe, 00000002.00000002.449347189.0000000002DA5000.00000004.00000001.sdmp, Purchase Order.gz.exe, 00000002.00000003.414789955.0000000000FB4000.00000004.00000001.sdmpString found in binary or memory: http://pLhkMTVj6DlFExpkl.com
              Source: Purchase Order.gz.exe, 00000002.00000002.449056486.0000000002D51000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
              Source: Purchase Order.gz.exe, 00000000.00000002.214850532.0000000007112000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
              Source: Purchase Order.gz.exe, 00000002.00000002.449056486.0000000002D51000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org
              Source: Purchase Order.gz.exe, 00000002.00000002.449056486.0000000002D51000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org/
              Source: Purchase Order.gz.exe, 00000002.00000002.449056486.0000000002D51000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.orgGETMozilla/5.0
              Source: Purchase Order.gz.exe, 00000000.00000002.208494696.0000000004299000.00000004.00000001.sdmp, Purchase Order.gz.exe, 00000002.00000002.444658237.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/
              Source: Purchase Order.gz.exe, 00000002.00000002.449056486.0000000002D51000.00000004.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
              Source: Purchase Order.gz.exe, 00000002.00000002.447457945.0000000001186000.00000004.00000001.sdmpString found in binary or memory: https://secure.comodo.com/CPS0
              Source: Purchase Order.gz.exe, 00000000.00000002.208494696.0000000004299000.00000004.00000001.sdmp, Purchase Order.gz.exe, 00000002.00000002.444658237.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
              Source: Purchase Order.gz.exe, 00000002.00000002.449056486.0000000002D51000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
              Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
              Source: Purchase Order.gz.exe, 00000000.00000002.203493144.0000000001438000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

              System Summary:

              barindex
              Initial sample is a PE file and has a suspicious nameShow sources
              Source: initial sampleStatic PE information: Filename: Purchase Order.gz.exe
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_00C5494B0_2_00C5494B
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_0140CD540_2_0140CD54
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_07893F400_2_07893F40
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_078976280_2_07897628
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_078926680_2_07892668
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_078943F00_2_078943F0
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_0789521B0_2_0789521B
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_078978800_2_07897880
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_07893E810_2_07893E81
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_07898ED30_2_07898ED3
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_07893EE10_2_07893EE1
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_078956080_2_07895608
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_078926580_2_07892658
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_078943E00_2_078943E0
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_078973410_2_07897341
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_07897AD10_2_07897AD1
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_07897AED0_2_07897AED
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_07897A6B0_2_07897A6B
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_078971080_2_07897108
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_078929300_2_07892930
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_078929400_2_07892940
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_078970F00_2_078970F0
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_078900070_2_07890007
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_078900400_2_07890040
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_078978730_2_07897873
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 1_2_0015494B1_2_0015494B
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_009D494B2_2_009D494B
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_012C46A02_2_012C46A0
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_012C35C42_2_012C35C4
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_012C45B02_2_012C45B0
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_012C46902_2_012C4690
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_012C53912_2_012C5391
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_012CDA002_2_012CDA00
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_060D94F82_2_060D94F8
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_060D75402_2_060D7540
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_060D6C702_2_060D6C70
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_060D69282_2_060D6928
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_060D25482_2_060D2548
              Source: Purchase Order.gz.exe, 00000000.00000002.203493144.0000000001438000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Purchase Order.gz.exe
              Source: Purchase Order.gz.exe, 00000000.00000002.204775698.0000000003271000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameHutaba.dll, vs Purchase Order.gz.exe
              Source: Purchase Order.gz.exe, 00000000.00000002.206475441.00000000037B2000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameCsuVxglbawDngIyXawbNOqMcnfMjDQeASn.exe4 vs Purchase Order.gz.exe
              Source: Purchase Order.gz.exe, 00000000.00000002.215976807.0000000007D00000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameB2B.exe4 vs Purchase Order.gz.exe
              Source: Purchase Order.gz.exe, 00000000.00000000.176999462.0000000000CE0000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamesPn.exe: vs Purchase Order.gz.exe
              Source: Purchase Order.gz.exe, 00000001.00000002.201324836.00000000001E0000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamesPn.exe: vs Purchase Order.gz.exe
              Source: Purchase Order.gz.exe, 00000002.00000002.445259213.0000000000A60000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamesPn.exe: vs Purchase Order.gz.exe
              Source: Purchase Order.gz.exe, 00000002.00000002.444658237.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameCsuVxglbawDngIyXawbNOqMcnfMjDQeASn.exe4 vs Purchase Order.gz.exe
              Source: Purchase Order.gz.exe, 00000002.00000002.459692970.00000000064C0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx vs Purchase Order.gz.exe
              Source: Purchase Order.gz.exe, 00000002.00000002.445295458.0000000000BF7000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs Purchase Order.gz.exe
              Source: Purchase Order.gz.exe, 00000002.00000002.459789030.0000000006660000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Purchase Order.gz.exe
              Source: Purchase Order.gz.exeBinary or memory string: OriginalFilenamesPn.exe: vs Purchase Order.gz.exe
              Source: Purchase Order.gz.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@5/1@4/3
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Order.gz.exe.logJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeMutant created: \Sessions\1\BaseNamedObjects\hUKdtKOyF
              Source: Purchase Order.gz.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: Purchase Order.gz.exeVirustotal: Detection: 40%
              Source: Purchase Order.gz.exeReversingLabs: Detection: 43%
              Source: unknownProcess created: C:\Users\user\Desktop\Purchase Order.gz.exe 'C:\Users\user\Desktop\Purchase Order.gz.exe'
              Source: unknownProcess created: C:\Users\user\Desktop\Purchase Order.gz.exe {path}
              Source: unknownProcess created: C:\Users\user\Desktop\Purchase Order.gz.exe {path}
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess created: C:\Users\user\Desktop\Purchase Order.gz.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess created: C:\Users\user\Desktop\Purchase Order.gz.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: Purchase Order.gz.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: Purchase Order.gz.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

              Data Obfuscation:

              barindex
              .NET source code contains method to dynamically call methods (often used by packers)Show sources
              Source: Purchase Order.gz.exe, fD?????UKvk?/???V?EvoSd.cs.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, eS?Ogw???? }, null, null)
              Source: 0.2.Purchase Order.gz.exe.c50000.0.unpack, fD?????UKvk?/???V?EvoSd.cs.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, eS?Ogw???? }, null, null)
              Source: 0.0.Purchase Order.gz.exe.c50000.0.unpack, fD?????UKvk?/???V?EvoSd.cs.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, eS?Ogw???? }, null, null)
              Source: 1.2.Purchase Order.gz.exe.150000.0.unpack, fD?????UKvk?/???V?EvoSd.cs.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, eS?Ogw???? }, null, null)
              Source: 1.0.Purchase Order.gz.exe.150000.0.unpack, fD?????UKvk?/???V?EvoSd.cs.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, eS?Ogw???? }, null, null)
              Source: 2.0.Purchase Order.gz.exe.9d0000.0.unpack, fD?????UKvk?/???V?EvoSd.cs.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, eS?Ogw???? }, null, null)
              Source: 2.2.Purchase Order.gz.exe.9d0000.1.unpack, fD?????UKvk?/???V?EvoSd.cs.Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, eS?Ogw???? }, null, null)
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_07894D69 push ecx; ret 0_2_07894D6A
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 0_2_07894D70 push ecx; ret 0_2_07894D71
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_060DA61F push es; iretd 2_2_060DA63C
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_060D8540 push es; ret 2_2_060D8550
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_060DEB38 push eax; ret 2_2_060DEC09
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_060DF8E2 push esp; retf 2_2_060DF8E9
              Source: initial sampleStatic PE information: section name: .text entropy: 7.47526161807
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Yara detected AntiVM_3Show sources
              Source: Yara matchFile source: Process Memory Space: Purchase Order.gz.exe PID: 4604, type: MEMORY
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
              Source: Purchase Order.gz.exe, 00000000.00000002.208224021.0000000003A73000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
              Source: Purchase Order.gz.exe, 00000000.00000002.208224021.0000000003A73000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeWindow / User API: threadDelayed 583Jump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 472Thread sleep time: -41500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 912Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -3689348814741908s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7160Thread sleep count: 210 > 30Jump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -55782s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -53376s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 4112Thread sleep count: 583 > 30Jump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -89721s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -59626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -58906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -58500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -57814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -57626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -57000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -56720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -56500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -56314s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -55626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -55220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -55000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -54814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -81471s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -54126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -53720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -53220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -53000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -52814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -51720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -51500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -50814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -50126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -49906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -49720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -49500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -48814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -48626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -48220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -48000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -47720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -46814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -46626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -46220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -45720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -45500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -44626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -43814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -43126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -42720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -42500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -42220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -42000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -41814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -40906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -40720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -40500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -40314s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -39814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -38720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -38500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -37406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -36126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -35220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -33906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -32814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -32626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -31720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -31500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -30626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -30406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exe TID: 7148Thread sleep time: -45220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeLast function: Thread delayed
              Source: Purchase Order.gz.exe, 00000000.00000002.208224021.0000000003A73000.00000004.00000001.sdmpBinary or memory string: vmware
              Source: Purchase Order.gz.exe, 00000000.00000002.208224021.0000000003A73000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
              Source: Purchase Order.gz.exe, 00000000.00000002.208224021.0000000003A73000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
              Source: Purchase Order.gz.exe, 00000000.00000002.208224021.0000000003A73000.00000004.00000001.sdmpBinary or memory string: VMWARE
              Source: Purchase Order.gz.exe, 00000000.00000002.208224021.0000000003A73000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
              Source: Purchase Order.gz.exe, 00000000.00000002.208224021.0000000003A73000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
              Source: Purchase Order.gz.exe, 00000000.00000002.208224021.0000000003A73000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
              Source: Purchase Order.gz.exe, 00000000.00000002.208224021.0000000003A73000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
              Source: Purchase Order.gz.exe, 00000002.00000002.447433957.0000000001180000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeCode function: 2_2_060DC8BE KiUserExceptionDispatcher,KiUserExceptionDispatcher,KiUserExceptionDispatcher,KiUserExceptionDispatcher,LdrInitializeThunk,2_2_060DC8BE
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion:

              barindex
              Injects a PE file into a foreign processesShow sources
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeMemory written: C:\Users\user\Desktop\Purchase Order.gz.exe base: 400000 value starts with: 4D5AJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess created: C:\Users\user\Desktop\Purchase Order.gz.exe {path}Jump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeProcess created: C:\Users\user\Desktop\Purchase Order.gz.exe {path}Jump to behavior
              Source: Purchase Order.gz.exe, 00000002.00000002.448556943.0000000001800000.00000002.00000001.sdmpBinary or memory string: Program Manager
              Source: Purchase Order.gz.exe, 00000002.00000002.448556943.0000000001800000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: Purchase Order.gz.exe, 00000002.00000002.448556943.0000000001800000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: Purchase Order.gz.exe, 00000002.00000002.448556943.0000000001800000.00000002.00000001.sdmpBinary or memory string: Progmanlock
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Users\user\Desktop\Purchase Order.gz.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Purchase Order.gz.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation