Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report Purchase Order.exe

Overview

General Information

Sample Name:Purchase Order.exe
Analysis ID:323818
MD5:596a39167153d9a5a4849d7b3a45ba58
SHA1:9f9f0a1d338200dfc3911e3cdda5acbeb6527fd3
SHA256:656b086e8dca8fc10f4527b417be09a34cce186fe1ade61c38fe56775cc86e5b
Tags:AgentTeslaexe

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Adds a directory exclusion to Windows Defender
Binary contains a suspicious time stamp
Connects to a pastebin service (likely for C&C)
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Drops PE files to the startup folder
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE / OLE file has an invalid certificate
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • Purchase Order.exe (PID: 2100 cmdline: 'C:\Users\user\Desktop\Purchase Order.exe' MD5: 596A39167153D9A5A4849D7B3A45BA58)
    • timeout.exe (PID: 5996 cmdline: timeout 4 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)
      • conhost.exe (PID: 5476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 852 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 1124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 6156 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 6220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 6212 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 6260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 6320 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Purchase Order.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 6396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • Purchase Order.exe (PID: 7156 cmdline: C:\Users\user\Desktop\Purchase Order.exe MD5: 596A39167153D9A5A4849D7B3A45BA58)
  • Purchase Order.exe (PID: 1752 cmdline: 'C:\Users\user\Desktop\Purchase Order.exe' MD5: 596A39167153D9A5A4849D7B3A45BA58)
    • timeout.exe (PID: 1328 cmdline: timeout 4 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)
      • conhost.exe (PID: 1256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • Purchase Order.exe (PID: 5244 cmdline: 'C:\Users\user\Desktop\Purchase Order.exe' MD5: 596A39167153D9A5A4849D7B3A45BA58)
    • timeout.exe (PID: 7136 cmdline: timeout 4 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)
      • conhost.exe (PID: 5792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • Purchase Order.exe (PID: 4660 cmdline: 'C:\Users\user\Desktop\Purchase Order.exe' MD5: 596A39167153D9A5A4849D7B3A45BA58)
    • timeout.exe (PID: 5860 cmdline: timeout 4 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)
      • conhost.exe (PID: 5228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • Purchase Order.exe (PID: 5268 cmdline: 'C:\Users\user\Desktop\Purchase Order.exe' MD5: 596A39167153D9A5A4849D7B3A45BA58)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000018.00000002.411043427.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000018.00000002.429643390.0000000002F91000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000018.00000002.429643390.0000000002F91000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        24.2.Purchase Order.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

          Sigma Overview

          No Sigma rule has matched

          Signature Overview

          Click to jump to signature section

          Show All Signature Results

          AV Detection:

          barindex
          Multi AV Scanner detection for dropped fileShow sources
          Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exeVirustotal: Detection: 30%Perma Link
          Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exeReversingLabs: Detection: 27%
          Multi AV Scanner detection for submitted fileShow sources
          Source: Purchase Order.exeReversingLabs: Detection: 27%
          Source: 24.2.Purchase Order.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8

          Networking:

          barindex
          Connects to a pastebin service (likely for C&C)Show sources
          Source: unknownDNS query: name: hastebin.com
          Source: unknownDNS query: name: pastebin.com
          Source: unknownDNS query: name: hastebin.com
          Source: unknownDNS query: name: hastebin.com
          Source: unknownDNS query: name: hastebin.com
          Source: unknownDNS query: name: hastebin.com
          Source: unknownDNS query: name: pastebin.com
          Source: Joe Sandbox ViewIP Address: 104.23.98.190 104.23.98.190
          Source: Joe Sandbox ViewIP Address: 104.23.98.190 104.23.98.190
          Source: Joe Sandbox ViewIP Address: 172.67.143.180 172.67.143.180
          Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
          Source: unknownDNS traffic detected: queries for: hastebin.com
          Source: powershell.exe, 00000008.00000002.542244419.0000000009CC2000.00000004.00000001.sdmpString found in binary or memory: http://crl.m
          Source: powershell.exe, 00000008.00000002.524029033.0000000005FD4000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.525983055.0000000005744000.00000004.00000001.sdmp, powershell.exe, 0000000B.00000002.524178959.0000000005C54000.00000004.00000001.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
          Source: powershell.exe, 0000000A.00000002.509897472.0000000004822000.00000004.00000001.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
          Source: powershell.exe, 00000008.00000002.508155931.000000000519D000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.511606909.000000000490D000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
          Source: powershell.exe, 00000008.00000002.503463181.0000000004F71000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.507587732.00000000046E1000.00000004.00000001.sdmp, powershell.exe, 0000000B.00000002.506752967.0000000004BF1000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: powershell.exe, 00000008.00000002.508155931.000000000519D000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.511606909.000000000490D000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
          Source: powershell.exe, 0000000A.00000002.509897472.0000000004822000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
          Source: powershell.exe, 0000000B.00000002.524178959.0000000005C54000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/
          Source: powershell.exe, 0000000B.00000002.524178959.0000000005C54000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/Icon
          Source: powershell.exe, 0000000B.00000002.524178959.0000000005C54000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/License
          Source: powershell.exe, 0000000A.00000002.509897472.0000000004822000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Pester/Pester
          Source: Purchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpString found in binary or memory: https://hastebin.com/raw/aliyepiqox
          Source: Purchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpString found in binary or memory: https://hastebin.com/raw/duholiwaga
          Source: Purchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpString found in binary or memory: https://hastebin.com/raw/ehakafilad
          Source: Purchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpString found in binary or memory: https://hastebin.com/raw/ekebahoxiz
          Source: Purchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpString found in binary or memory: https://hastebin.com/raw/gozovupono
          Source: Purchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpString found in binary or memory: https://hastebin.com/raw/lutejitifu
          Source: Purchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpString found in binary or memory: https://hastebin.com/raw/oxihusiwib
          Source: Purchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpString found in binary or memory: https://hastebin.com/raw/rinitihulu
          Source: Purchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpString found in binary or memory: https://hastebin.com/raw/sololedeto
          Source: Purchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpString found in binary or memory: https://hastebin.com/raw/uwukixowoh
          Source: Purchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpString found in binary or memory: https://hastebin.com/raw/uxubocuvah
          Source: Purchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpString found in binary or memory: https://hastebin.com/raw/xoqevokuwo
          Source: Purchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpString found in binary or memory: https://hastebin.com/raw/zuquyuqaxa
          Source: Purchase Order.exe, 00000027.00000002.446927009.0000000003590000.00000004.00000001.sdmpString found in binary or memory: https://hastebin.comD8
          Source: powershell.exe, 00000008.00000002.524029033.0000000005FD4000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.525983055.0000000005744000.00000004.00000001.sdmp, powershell.exe, 0000000B.00000002.524178959.0000000005C54000.00000004.00000001.sdmpString found in binary or memory: https://nuget.org/nuget.exe
          Source: Purchase Order.exe, 00000027.00000002.446927009.0000000003590000.00000004.00000001.sdmpString found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
          Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
          Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
          Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443

          System Summary:

          barindex
          Executable has a suspicious name (potential lure to open the executable)Show sources
          Source: Purchase Order.exeStatic file information: Suspicious name
          Initial sample is a PE file and has a suspicious nameShow sources
          Source: initial sampleStatic PE information: Filename: Purchase Order.exe
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_034E45D0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_034EB9C0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_0353B238
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_035384B8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_0356F3A8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_007DBD68
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_00AE7EA0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_07888680
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_02BC8058
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_02BC6A70
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_02BC0040
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_02BC1470
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_02BD8350
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_02BD6EC8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_07E48CC0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_07E48CD0
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_07E48C68
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_07E57E00
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_07E57E00
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07527E00
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07527E00
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_079D1A10
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_079DAAB8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_079DAAA7
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_079D1A00
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_079D9958
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_079D9949
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07A8A268
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07A8358F
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07A8D3A8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07A892E8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07A830CC
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07A83CE8
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07520040
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_0752001D
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07A845C1
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07A8DE20
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_07A8DE30
          Source: Purchase Order.exeStatic PE information: invalid certificate
          Source: Purchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameServiceHub.Host.CLR.exeH vs Purchase Order.exe
          Source: classification engineClassification label: mal100.troj.adwa.evad.winEXE@32/16@7/2
          Source: C:\Users\user\Desktop\Purchase Order.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exeJump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1124:120:WilError_01
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6260:120:WilError_01
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5792:120:WilError_01
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6396:120:WilError_01
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6220:120:WilError_01
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1256:120:WilError_01
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5476:120:WilError_01
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5228:120:WilError_01
          Source: C:\Users\user\Desktop\Purchase Order.exeFile created: C:\Users\user\AppData\Local\Temp\d0103aef-d6ec-4866-a6db-fe7e82874b3fJump to behavior
          Source: Purchase Order.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Users\user\Desktop\Purchase Order.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Users\user\Desktop\Purchase Order.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\Purchase Order.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
          Source: C:\Users\user\Desktop\Purchase Order.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Desktop\Purchase Order.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Desktop\Purchase Order.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Desktop\Purchase Order.exeFile read: C:\Windows\System32\drivers\etc\hosts
          Source: C:\Users\user\Desktop\Purchase Order.exeFile read: C:\Windows\System32\drivers\etc\hosts
          Source: C:\Users\user\Desktop\Purchase Order.exeFile read: C:\Windows\System32\drivers\etc\hosts
          Source: C:\Users\user\Desktop\Purchase Order.exeFile read: C:\Windows\System32\drivers\etc\hosts
          Source: C:\Users\user\Desktop\Purchase Order.exeFile read: C:\Windows\System32\drivers\etc\hosts
          Source: C:\Users\user\Desktop\Purchase Order.exeFile read: C:\Windows\System32\drivers\etc\hosts
          Source: Purchase Order.exeReversingLabs: Detection: 27%
          Source: C:\Users\user\Desktop\Purchase Order.exeFile read: C:\Users\user\Desktop\Purchase Order.exeJump to behavior
          Source: unknownProcess created: C:\Users\user\Desktop\Purchase Order.exe 'C:\Users\user\Desktop\Purchase Order.exe'
          Source: unknownProcess created: C:\Windows\SysWOW64\timeout.exe timeout 4
          Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: unknownProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
          Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: unknownProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
          Source: unknownProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
          Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: unknownProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Purchase Order.exe' -Force
          Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: unknownProcess created: C:\Users\user\Desktop\Purchase Order.exe C:\Users\user\Desktop\Purchase Order.exe
          Source: unknownProcess created: C:\Users\user\Desktop\Purchase Order.exe 'C:\Users\user\Desktop\Purchase Order.exe'
          Source: unknownProcess created: C:\Windows\SysWOW64\timeout.exe timeout 4
          Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: unknownProcess created: C:\Users\user\Desktop\Purchase Order.exe 'C:\Users\user\Desktop\Purchase Order.exe'
          Source: unknownProcess created: C:\Windows\SysWOW64\timeout.exe timeout 4
          Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: unknownProcess created: C:\Users\user\Desktop\Purchase Order.exe 'C:\Users\user\Desktop\Purchase Order.exe'
          Source: unknownProcess created: C:\Windows\SysWOW64\timeout.exe timeout 4
          Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: unknownProcess created: C:\Users\user\Desktop\Purchase Order.exe 'C:\Users\user\Desktop\Purchase Order.exe'
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout 4
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Purchase Order.exe' -Force
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Users\user\Desktop\Purchase Order.exe C:\Users\user\Desktop\Purchase Order.exe
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout 4
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout 4
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout 4
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\Purchase Order.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Users\user\Desktop\Purchase Order.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
          Source: Purchase Order.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: Purchase Order.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
          Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000008.00000002.531031649.00000000080BB000.00000004.00000001.sdmp

          Data Obfuscation:

          barindex
          Binary contains a suspicious time stampShow sources
          Source: initial sampleStatic PE information: 0xCBFB3E96 [Sun Jun 12 06:20:06 2078 UTC]
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_034E1ED8 push eax; mov dword ptr [esp], edx
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_03560B58 push eax; mov dword ptr [esp], edx
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_007D1DE7 push eax; mov dword ptr [esp], edx
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_00AEAA50 push es; ret
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_07887621 push eax; iretd
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_07887F51 push es; ret
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_02BC6050 push eax; mov dword ptr [esp], edx
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_02BC2137 push eax; mov dword ptr [esp], edx
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_02BDA998 pushad ; iretd
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 11_2_02BD5D32 push eax; mov dword ptr [esp], edx
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_0752D710 push es; ret
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_079D8B69 push eax; ret
          Source: C:\Users\user\Desktop\Purchase Order.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exeJump to dropped file

          Boot Survival:

          barindex
          Creates an undocumented autostart registry key Show sources
          Source: C:\Users\user\Desktop\Purchase Order.exeKey value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon shellJump to behavior
          Creates autostart registry keys with suspicious namesShow sources
          Source: C:\Users\user\Desktop\Purchase Order.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run <Unknown>Jump to behavior
          Creates multiple autostart registry keysShow sources
          Source: C:\Users\user\Desktop\Purchase Order.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run <Unknown>Jump to behavior
          Source: C:\Users\user\Desktop\Purchase Order.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Purchase Order.exeJump to behavior
          Drops PE files to the startup folderShow sources
          Source: C:\Users\user\Desktop\Purchase Order.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exeJump to dropped file
          Source: C:\Users\user\Desktop\Purchase Order.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exeJump to behavior
          Source: C:\Users\user\Desktop\Purchase Order.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exeJump to behavior
          Source: C:\Users\user\Desktop\Purchase Order.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe\:Zone.Identifier:$DATAJump to behavior
          Source: C:\Users\user\Desktop\Purchase Order.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run <Unknown>Jump to behavior
          Source: C:\Users\user\Desktop\Purchase Order.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run <Unknown>Jump to behavior
          Source: C:\Users\user\Desktop\Purchase Order.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Purchase Order.exeJump to behavior
          Source: C:\Users\user\Desktop\Purchase Order.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Purchase Order.exeJump to behavior
          Source: C:\Users\user\Desktop\Purchase Order.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess information set: NOOPENFILEERRORBOX

          Malware Analysis System Evasion:

          barindex
          Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
          Source: C:\Users\user\Desktop\Purchase Order.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
          Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)Show sources
          Source: C:\Users\user\Desktop\Purchase Order.exeWMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
          Source: C:\Users\user\Desktop\Purchase Order.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
          Source: C:\Users\user\Desktop\Purchase Order.exeFile opened / queried: C:\WINDOWS\SysWOW64\drivers\vmmouse.sys
          Source: C:\Users\user\Desktop\Purchase Order.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier
          Source: C:\Users\user\Desktop\Purchase Order.exeFile opened / queried: C:\WINDOWS\SysWOW64\drivers\vmhgfs.sys
          Source: C:\Users\user\Desktop\Purchase Order.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
          Source: C:\Users\user\Desktop\Purchase Order.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
          Source: C:\Users\user\Desktop\Purchase Order.exeFile opened / queried: C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys
          Source: C:\Users\user\Desktop\Purchase Order.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: C:\Users\user\Desktop\Purchase Order.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0
          Source: C:\Users\user\Desktop\Purchase Order.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
          Source: C:\Users\user\Desktop\Purchase Order.exeThread delayed: delay time: 922337203685477
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 871
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 817
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 840
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 366
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 933
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 522
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 389
          Source: C:\Users\user\Desktop\Purchase Order.exe TID: 5468Thread sleep time: -30000s >= -30000s
          Source: C:\Users\user\Desktop\Purchase Order.exe TID: 5316Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6716Thread sleep time: -13835058055282155s >= -30000s
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6716Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6380Thread sleep count: 840 > 30
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6380Thread sleep count: 366 > 30
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6584Thread sleep count: 46 > 30
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7000Thread sleep time: -11068046444225724s >= -30000s
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7000Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6428Thread sleep count: 933 > 30
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6428Thread sleep count: 522 > 30
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6580Thread sleep count: 49 > 30
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6436Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6508Thread sleep count: 389 > 30
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6496Thread sleep count: 240 > 30
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6596Thread sleep count: 39 > 30
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6348Thread sleep time: -8301034833169293s >= -30000s
          Source: C:\Windows\SysWOW64\timeout.exe TID: 7140Thread sleep count: 35 > 30
          Source: C:\Windows\SysWOW64\timeout.exe TID: 5280Thread sleep count: 34 > 30
          Source: C:\Users\user\Desktop\Purchase Order.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\Purchase Order.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\Purchase Order.exeLast function: Thread delayed
          Source: powershell.exe, 00000008.00000002.542897065.0000000009F30000.00000002.00000001.sdmp, powershell.exe, 0000000A.00000002.548065821.0000000009630000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
          Source: powershell.exe, 00000008.00000002.542897065.0000000009F30000.00000002.00000001.sdmp, powershell.exe, 0000000A.00000002.548065821.0000000009630000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
          Source: powershell.exe, 00000008.00000002.542897065.0000000009F30000.00000002.00000001.sdmp, powershell.exe, 0000000A.00000002.548065821.0000000009630000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
          Source: powershell.exe, 00000008.00000002.507257656.00000000050B1000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.509897472.0000000004822000.00000004.00000001.sdmpBinary or memory string: l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
          Source: powershell.exe, 00000008.00000002.542897065.0000000009F30000.00000002.00000001.sdmp, powershell.exe, 0000000A.00000002.548065821.0000000009630000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess token adjusted: Debug
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess token adjusted: Debug
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess token adjusted: Debug
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess token adjusted: Debug
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess token adjusted: Debug
          Source: C:\Users\user\Desktop\Purchase Order.exeMemory allocated: page read and write | page guard

          HIPS / PFW / Operating System Protection Evasion:

          barindex
          Adds a directory exclusion to Windows DefenderShow sources
          Source: unknownProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
          Source: unknownProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
          Source: unknownProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
          Source: unknownProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Purchase Order.exe' -Force
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Purchase Order.exe' -Force
          Injects a PE file into a foreign processesShow sources
          Source: C:\Users\user\Desktop\Purchase Order.exeMemory written: C:\Users\user\Desktop\Purchase Order.exe base: 400000 value starts with: 4D5A
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Purchase Order.exe' -Force
          Source: C:\Users\user\Desktop\Purchase Order.exeProcess created: C:\Users\user\Desktop\Purchase Order.exe C:\Users\user\Desktop\Purchase Order.exe
          Source: powershell.exe, 0000000A.00000002.504887698.0000000003130000.00000002.00000001.sdmpBinary or memory string: Program Manager
          Source: powershell.exe, 0000000A.00000002.504887698.0000000003130000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
          Source: powershell.exe, 0000000A.00000002.504887698.0000000003130000.00000002.00000001.sdmpBinary or memory string: Progman
          Source: powershell.exe, 0000000A.00000002.504887698.0000000003130000.00000002.00000001.sdmpBinary or memory string: Progmanlock
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Users\user\Desktop\Purchase Order.exe VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Users\user\Desktop\Purchase Order.exe VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Users\user\Desktop\Purchase Order.exe VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Users\user\Desktop\Purchase Order.exe VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Users\user\Desktop\Purchase Order.exe VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Users\user\Desktop\Purchase Order.exe VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Desktop\Purchase Order.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

          Stealing of Sensitive Information:

          barindex
          Yara detected AgentTeslaShow sources
          Source: Yara matchFile source: 00000018.00000002.411043427.0000000000402000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000018.00000002.429643390.0000000002F91000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 24.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000018.00000002.429643390.0000000002F91000.00000004.00000001.sdmp, type: MEMORY

          Remote Access Functionality:

          barindex
          Yara detected AgentTeslaShow sources
          Source: Yara matchFile source: 00000018.00000002.411043427.0000000000402000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000018.00000002.429643390.0000000002F91000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 24.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid AccountsWindows Management Instrumentation21Startup Items1Startup Items1Masquerading1OS Credential DumpingQuery Registry1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumWeb Service1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default AccountsScheduled Task/JobRegistry Run Keys / Startup Folder421Process Injection112Virtualization/Sandbox Evasion14LSASS MemorySecurity Software Discovery221Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothEncrypted Channel12Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Registry Run Keys / Startup Folder421Disable or Modify Tools11Security Account ManagerVirtualization/Sandbox Evasion14SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationNon-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection112NTDSProcess Discovery2Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol2SIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information1LSA SecretsApplication Window Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.commonSoftware Packing1Cached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup ItemsTimestomp1DCSyncFile and Directory Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
          Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemSystem Information Discovery122Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 323818 Sample: Purchase Order.exe Startdate: 27/11/2020 Architecture: WINDOWS Score: 100 55 pastebin.com 2->55 57 hastebin.com 2->57 63 Multi AV Scanner detection for dropped file 2->63 65 Multi AV Scanner detection for submitted file 2->65 67 Yara detected AgentTesla 2->67 69 8 other signatures 2->69 8 Purchase Order.exe 24 7 2->8         started        13 Purchase Order.exe 2->13         started        15 Purchase Order.exe 2->15         started        17 2 other processes 2->17 signatures3 process4 dnsIp5 59 pastebin.com 104.23.98.190, 443, 49733 CLOUDFLARENETUS United States 8->59 61 hastebin.com 172.67.143.180, 443, 49724, 49750 CLOUDFLARENETUS United States 8->61 49 C:\Users\user\AppData\...\Purchase Order.exe, PE32 8->49 dropped 51 C:\...\Purchase Order.exe:Zone.Identifier, ASCII 8->51 dropped 53 C:\Users\user\...\Purchase Order.exe.log, ASCII 8->53 dropped 71 Creates an undocumented autostart registry key 8->71 73 Creates autostart registry keys with suspicious names 8->73 75 Creates multiple autostart registry keys 8->75 77 2 other signatures 8->77 19 powershell.exe 8 8->19         started        21 powershell.exe 10 8->21         started        23 powershell.exe 10 8->23         started        31 3 other processes 8->31 25 timeout.exe 13->25         started        27 timeout.exe 15->27         started        29 timeout.exe 17->29         started        file6 signatures7 process8 process9 33 conhost.exe 19->33         started        35 conhost.exe 21->35         started        37 conhost.exe 23->37         started        39 conhost.exe 25->39         started        41 conhost.exe 27->41         started        43 conhost.exe 29->43         started        45 conhost.exe 31->45         started        47 conhost.exe 31->47         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.

          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          Purchase Order.exe27%ReversingLabsByteCode-MSIL.Trojan.AgentTesla

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe30%VirustotalBrowse
          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe27%ReversingLabsByteCode-MSIL.Trojan.AgentTesla

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          24.2.Purchase Order.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File

          Domains

          No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
          http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
          http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
          http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
          https://contoso.com/License0%URL Reputationsafe
          https://contoso.com/License0%URL Reputationsafe
          https://contoso.com/License0%URL Reputationsafe
          https://contoso.com/License0%URL Reputationsafe
          https://contoso.com/Icon0%URL Reputationsafe
          https://contoso.com/Icon0%URL Reputationsafe
          https://contoso.com/Icon0%URL Reputationsafe
          https://contoso.com/Icon0%URL Reputationsafe
          https://hastebin.comD80%Avira URL Cloudsafe
          http://crl.m0%URL Reputationsafe
          http://crl.m0%URL Reputationsafe
          http://crl.m0%URL Reputationsafe
          http://crl.m0%URL Reputationsafe
          https://contoso.com/0%URL Reputationsafe
          https://contoso.com/0%URL Reputationsafe
          https://contoso.com/0%URL Reputationsafe
          https://contoso.com/0%URL Reputationsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          hastebin.com
          		172.67.143.180
          		truefalse
            		high
            pastebin.com
            		104.23.98.190
            		truefalse
              		high

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              http://nuget.org/NuGet.exepowershell.exe, 00000008.00000002.524029033.0000000005FD4000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.525983055.0000000005744000.00000004.00000001.sdmp, powershell.exe, 0000000B.00000002.524178959.0000000005C54000.00000004.00000001.sdmpfalse
                		high
                https://hastebin.com/raw/rinitihuluPurchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpfalse
                  		high
                  http://pesterbdd.com/images/Pester.pngpowershell.exe, 0000000A.00000002.509897472.0000000004822000.00000004.00000001.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  		unknown
                  http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000008.00000002.508155931.000000000519D000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.511606909.000000000490D000.00000004.00000001.sdmpfalse
                    		high
                    http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 0000000A.00000002.509897472.0000000004822000.00000004.00000001.sdmpfalse
                      		high
                      https://hastebin.com/raw/ehakafiladPurchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpfalse
                        		high
                        https://contoso.com/Licensepowershell.exe, 0000000B.00000002.524178959.0000000005C54000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        https://contoso.com/Iconpowershell.exe, 0000000B.00000002.524178959.0000000005C54000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        https://hastebin.com/raw/duholiwagaPurchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpfalse
                          		high
                          https://hastebin.com/raw/uxubocuvahPurchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpfalse
                            		high
                            https://hastebin.comD8Purchase Order.exe, 00000027.00000002.446927009.0000000003590000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://github.com/Pester/Pesterpowershell.exe, 0000000A.00000002.509897472.0000000004822000.00000004.00000001.sdmpfalse
                              		high
                              https://hastebin.com/raw/sololedetoPurchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpfalse
                                		high
                                http://crl.mpowershell.exe, 00000008.00000002.542244419.0000000009CC2000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                https://hastebin.com/raw/lutejitifuPurchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpfalse
                                  		high
                                  https://hastebin.com/raw/aliyepiqoxPurchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpfalse
                                    		high
                                    https://hastebin.com/raw/oxihusiwibPurchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpfalse
                                      		high
                                      http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000008.00000002.508155931.000000000519D000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.511606909.000000000490D000.00000004.00000001.sdmpfalse
                                        		high
                                        https://contoso.com/powershell.exe, 0000000B.00000002.524178959.0000000005C54000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        https://nuget.org/nuget.exepowershell.exe, 00000008.00000002.524029033.0000000005FD4000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.525983055.0000000005744000.00000004.00000001.sdmp, powershell.exe, 0000000B.00000002.524178959.0000000005C54000.00000004.00000001.sdmpfalse
                                          		high
                                          https://hastebin.com/raw/ekebahoxizPurchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpfalse
                                            		high
                                            https://hastebin.com/raw/xoqevokuwoPurchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpfalse
                                              		high
                                              https://hastebin.com/raw/uwukixowohPurchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpfalse
                                                		high
                                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000008.00000002.503463181.0000000004F71000.00000004.00000001.sdmp, powershell.exe, 0000000A.00000002.507587732.00000000046E1000.00000004.00000001.sdmp, powershell.exe, 0000000B.00000002.506752967.0000000004BF1000.00000004.00000001.sdmpfalse
                                                  		high
                                                  https://hastebin.com/raw/gozovuponoPurchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpfalse
                                                    		high
                                                    https://hastebin.com/raw/zuquyuqaxaPurchase Order.exe, 00000000.00000000.206084767.0000000000362000.00000002.00020000.sdmpfalse
                                                      		high

                                                      Contacted IPs

                                                      • No. of IPs < 25%
                                                      • 25% < No. of IPs < 50%
                                                      • 50% < No. of IPs < 75%
                                                      • 75% < No. of IPs

                                                      Public

                                                      IPDomainCountryFlagASNASN NameMalicious
                                                      104.23.98.190
                                                      		unknownUnited States
                                                      		13335CLOUDFLARENETUSfalse
                                                      172.67.143.180
                                                      		unknownUnited States
                                                      		13335CLOUDFLARENETUSfalse

                                                      General Information

                                                      Joe Sandbox Version:31.0.0 Red Diamond
                                                      Analysis ID:323818
                                                      Start date:27.11.2020
                                                      Start time:15:46:27
                                                      Joe Sandbox Product:CloudBasic
                                                      Overall analysis duration:0h 14m 51s
                                                      Hypervisor based Inspection enabled:false
                                                      Report type:light
                                                      Sample file name:Purchase Order.exe
                                                      Cookbook file name:default.jbs
                                                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                      Number of analysed new started processes analysed:40
                                                      Number of new started drivers analysed:0
                                                      Number of existing processes analysed:0
                                                      Number of existing drivers analysed:0
                                                      Number of injected processes analysed:0
                                                      Technologies:
                                                      • HCA enabled
                                                      • EGA enabled
                                                      • HDC enabled
                                                      • AMSI enabled
                                                      Analysis Mode:default
                                                      Analysis stop reason:Timeout
                                                      Detection:MAL
                                                      Classification:mal100.troj.adwa.evad.winEXE@32/16@7/2
                                                      EGA Information:Failed
                                                      HDC Information:Failed
                                                      HCA Information:
                                                      • Successful, ratio: 99%
                                                      • Number of executed functions: 0
                                                      • Number of non-executed functions: 0
                                                      Cookbook Comments:
                                                      • Adjust boot time
                                                      • Enable AMSI
                                                      • Found application associated with file extension: .exe
                                                      Warnings:
                                                      Show All
                                                      • Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, svchost.exe, wuapihost.exe
                                                      • TCP Packets have been reduced to 100
                                                      • Excluded IPs from analysis (whitelisted): 104.43.193.48, 104.42.151.234, 40.88.32.150, 51.104.139.180, 92.122.213.247, 92.122.213.194, 23.210.248.85, 52.155.217.156, 20.54.26.129
                                                      • Excluded domains from analysis (whitelisted): displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, arc.msn.com.nsatc.net, fs.microsoft.com, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, skypedataprdcolcus15.cloudapp.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, ris.api.iris.microsoft.com, skypedataprdcoleus15.cloudapp.net, blobcollector.events.data.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, skypedataprdcolwus16.cloudapp.net
                                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                      • Report size exceeded maximum capacity and may have missing network information.
                                                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                      • Report size getting too big, too many NtQueryValueKey calls found.

                                                      Simulations

                                                      Behavior and APIs

                                                      TimeTypeDescription
                                                      15:48:37AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run <Unknown> C:\Users\user\Desktop\Purchase Order.exe
                                                      15:48:45API Interceptor1x Sleep call for process: Purchase Order.exe modified
                                                      15:48:45AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Purchase Order.exe C:\Users\user\Desktop\Purchase Order.exe
                                                      15:48:54AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run <Unknown> C:\Users\user\Desktop\Purchase Order.exe
                                                      15:49:04AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Purchase Order.exe C:\Users\user\Desktop\Purchase Order.exe
                                                      15:49:13AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe
                                                      15:49:55API Interceptor95x Sleep call for process: powershell.exe modified

                                                      Joe Sandbox View / Context

                                                      IPs

                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                      104.23.98.190b095b966805abb7df4ffddf183def880.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      E1Q0TjeN32.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      6YCl3ATKJw.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      Hjnb15Nuc3.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      JDgYMW0LHW.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      4av8Sn32by.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      5T4Ykc0VSK.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      afvhKak0Ir.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      T6OcyQsUsY.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      1KITgJnGbI.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      PxwWcmbMC5.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      XnAJZR4NcN.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      PbTwrajNMX.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      22NO7gVJ7r.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      rE7DwszvrX.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      VjPHSJkwr6.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      wf86K0dpOP.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      VrR9J0FnSG.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      6C1MYmrVl1.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      aTZQZVVriQ.exeGet hashmaliciousBrowse
                                                      • pastebin.com/raw/XMKKNkb0
                                                      172.67.143.180SecuriteInfo.com.Mal.Generic-S.26042.exeGet hashmaliciousBrowse
                                                        SecuriteInfo.com.Trojan.Siggen11.48004.19433.exeGet hashmaliciousBrowse
                                                          CSq58hA6nO.exeGet hashmaliciousBrowse
                                                            Order Catalogue Specifications.xlsxGet hashmaliciousBrowse
                                                              IFEvMPuK1t.exeGet hashmaliciousBrowse
                                                                PO91666. pdf.exeGet hashmaliciousBrowse
                                                                  8DHgG635TK.exeGet hashmaliciousBrowse
                                                                    NdAonNMuzm.exeGet hashmaliciousBrowse
                                                                      9fv6IffZmA.exeGet hashmaliciousBrowse
                                                                        plvSd6AoLp.exeGet hashmaliciousBrowse
                                                                          w6r8DJTtvF.exeGet hashmaliciousBrowse
                                                                            B67aSzPX6F.exeGet hashmaliciousBrowse
                                                                              3230_pdf.exeGet hashmaliciousBrowse
                                                                                P.O pdf pdf pdf pdf pdf ori40 ony.exeGet hashmaliciousBrowse
                                                                                  Shipping Details_PDF.exeGet hashmaliciousBrowse
                                                                                    #INVBEBON095834.pdf.exeGet hashmaliciousBrowse
                                                                                      #INVBEBON095835.pdf.exeGet hashmaliciousBrowse
                                                                                        xE08uG0aqO.exeGet hashmaliciousBrowse
                                                                                          Detalles de la descripci#U00f3n de la oferta del producto.exeGet hashmaliciousBrowse
                                                                                            Detalles de la descripci#U00f3n de la oferta del producto.exeGet hashmaliciousBrowse

                                                                                              Domains

                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                              pastebin.comSecuriteInfo.com.Trojan.Siggen11.49316.15393.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              SecuriteInfo.com.Trojan.Nanocore.23.20965.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              SecuriteInfo.com.Mal.Generic-S.26042.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              SecuriteInfo.com.BehavesLike.Win32.VirRansom.rm.exeGet hashmaliciousBrowse
                                                                                              • 104.23.99.190
                                                                                              SecuriteInfo.com.Trojan.KillProc2.14740.25300.exeGet hashmaliciousBrowse
                                                                                              • 104.23.99.190
                                                                                              due-invoice.xlsmGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              Order 51897.exeGet hashmaliciousBrowse
                                                                                              • 104.23.99.190
                                                                                              Statement Of Account.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              http://ancien-site-joomla.fr/build2.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              BTNCRKWd.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              Shipment Details.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              7iZX0KCH4C.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              IFEvMPuK1t.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              lzh-content.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              New Order.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              23prRlqeGr.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              BT2wDapfoI.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              23692 ANRITSU PROBE po 29288.exeGet hashmaliciousBrowse
                                                                                              • 104.23.99.190
                                                                                              PO #5618896.gz.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              ShippingDoc.jarGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              hastebin.comSecuriteInfo.com.Mal.Generic-S.26042.exeGet hashmaliciousBrowse
                                                                                              • 104.24.126.89
                                                                                              due-invoice.xlsmGet hashmaliciousBrowse
                                                                                              • 104.24.127.89
                                                                                              SecuriteInfo.com.Gen.NN.ZemsilF.34658.m0@a8V1yrei.exeGet hashmaliciousBrowse
                                                                                              • 104.24.126.89
                                                                                              Order 51897.exeGet hashmaliciousBrowse
                                                                                              • 104.24.127.89
                                                                                              AsyncClient.exeGet hashmaliciousBrowse
                                                                                              • 104.24.126.89
                                                                                              Statement Of Account.exeGet hashmaliciousBrowse
                                                                                              • 104.24.127.89
                                                                                              http://ancien-site-joomla.fr/build2.exeGet hashmaliciousBrowse
                                                                                              • 104.24.126.89
                                                                                              SecuriteInfo.com.ArtemisTrojan.exeGet hashmaliciousBrowse
                                                                                              • 104.24.126.89
                                                                                              SecuriteInfo.com.BackDoor.SpyBotNET.25.30157.exeGet hashmaliciousBrowse
                                                                                              • 104.24.127.89
                                                                                              C03N224Hbu.exeGet hashmaliciousBrowse
                                                                                              • 104.24.126.89
                                                                                              P.O_ 39134.xlsxGet hashmaliciousBrowse
                                                                                              • 104.24.127.89
                                                                                              EME.39134.xlsxGet hashmaliciousBrowse
                                                                                              • 104.24.127.89
                                                                                              SecuriteInfo.com.Trojan.Siggen11.48004.19433.exeGet hashmaliciousBrowse
                                                                                              • 172.67.143.180
                                                                                              Order List.xlsxGet hashmaliciousBrowse
                                                                                              • 104.24.127.89
                                                                                              CSq58hA6nO.exeGet hashmaliciousBrowse
                                                                                              • 172.67.143.180
                                                                                              Order Catalogue Specifications.xlsxGet hashmaliciousBrowse
                                                                                              • 172.67.143.180
                                                                                              Shipping Details_PDF.exeGet hashmaliciousBrowse
                                                                                              • 104.24.127.89
                                                                                              7iZX0KCH4C.exeGet hashmaliciousBrowse
                                                                                              • 104.24.126.89
                                                                                              IFEvMPuK1t.exeGet hashmaliciousBrowse
                                                                                              • 172.67.143.180
                                                                                              Shipping DOC_PDF.exeGet hashmaliciousBrowse
                                                                                              • 104.24.127.89

                                                                                              ASN

                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                              CLOUDFLARENETUScaw.exeGet hashmaliciousBrowse
                                                                                              • 162.159.138.232
                                                                                              Direct Deposit.xlsxGet hashmaliciousBrowse
                                                                                              • 104.16.19.94
                                                                                              Direct Deposit.xlsxGet hashmaliciousBrowse
                                                                                              • 104.16.19.94
                                                                                              https://is.gd/NLY8SbGet hashmaliciousBrowse
                                                                                              • 104.16.19.94
                                                                                              Soda_PDF_12_Installer (7).exeGet hashmaliciousBrowse
                                                                                              • 104.16.181.79
                                                                                              REQUEST FOR BID 26-11-2020.pptGet hashmaliciousBrowse
                                                                                              • 104.18.49.20
                                                                                              https://alldomainverifications.web.app#paulo.horta@gnbga.ptGet hashmaliciousBrowse
                                                                                              • 104.16.19.94
                                                                                              DHL_Nov 2020 at 1.85_8BZ290_PDF.jarGet hashmaliciousBrowse
                                                                                              • 104.20.23.46
                                                                                              DHL_Nov 2020 at 1.85_8BZ290_PDF.jarGet hashmaliciousBrowse
                                                                                              • 104.20.23.46
                                                                                              https://erabansoupala.blogspot.com//?m=0Get hashmaliciousBrowse
                                                                                              • 172.67.194.249
                                                                                              SecuriteInfo.com.Trojan.Siggen11.49316.15393.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              Re.Po ORDER.45355.SCAN.PDF...exeGet hashmaliciousBrowse
                                                                                              • 104.28.5.151
                                                                                              https://mincast.us-south.cf.appdomain.cloud/redirect/?email=prampon@soteb.frGet hashmaliciousBrowse
                                                                                              • 172.67.212.166
                                                                                              lxpo.exeGet hashmaliciousBrowse
                                                                                              • 162.159.128.233
                                                                                              SpecificationX20202611.xlsxGet hashmaliciousBrowse
                                                                                              • 162.159.136.232
                                                                                              SecuriteInfo.com.Trojan.Nanocore.23.20965.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              SecuriteInfo.com.Mal.Generic-S.26042.exeGet hashmaliciousBrowse
                                                                                              • 172.67.143.180
                                                                                              trackinginfo#U007eupdate.jarGet hashmaliciousBrowse
                                                                                              • 104.20.23.46
                                                                                              trackinginfo#U007eupdate.jarGet hashmaliciousBrowse
                                                                                              • 104.20.22.46
                                                                                              MAL.PPTGet hashmaliciousBrowse
                                                                                              • 172.67.219.133
                                                                                              CLOUDFLARENETUScaw.exeGet hashmaliciousBrowse
                                                                                              • 162.159.138.232
                                                                                              Direct Deposit.xlsxGet hashmaliciousBrowse
                                                                                              • 104.16.19.94
                                                                                              Direct Deposit.xlsxGet hashmaliciousBrowse
                                                                                              • 104.16.19.94
                                                                                              https://is.gd/NLY8SbGet hashmaliciousBrowse
                                                                                              • 104.16.19.94
                                                                                              Soda_PDF_12_Installer (7).exeGet hashmaliciousBrowse
                                                                                              • 104.16.181.79
                                                                                              REQUEST FOR BID 26-11-2020.pptGet hashmaliciousBrowse
                                                                                              • 104.18.49.20
                                                                                              https://alldomainverifications.web.app#paulo.horta@gnbga.ptGet hashmaliciousBrowse
                                                                                              • 104.16.19.94
                                                                                              DHL_Nov 2020 at 1.85_8BZ290_PDF.jarGet hashmaliciousBrowse
                                                                                              • 104.20.23.46
                                                                                              DHL_Nov 2020 at 1.85_8BZ290_PDF.jarGet hashmaliciousBrowse
                                                                                              • 104.20.23.46
                                                                                              https://erabansoupala.blogspot.com//?m=0Get hashmaliciousBrowse
                                                                                              • 172.67.194.249
                                                                                              SecuriteInfo.com.Trojan.Siggen11.49316.15393.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              Re.Po ORDER.45355.SCAN.PDF...exeGet hashmaliciousBrowse
                                                                                              • 104.28.5.151
                                                                                              https://mincast.us-south.cf.appdomain.cloud/redirect/?email=prampon@soteb.frGet hashmaliciousBrowse
                                                                                              • 172.67.212.166
                                                                                              lxpo.exeGet hashmaliciousBrowse
                                                                                              • 162.159.128.233
                                                                                              SpecificationX20202611.xlsxGet hashmaliciousBrowse
                                                                                              • 162.159.136.232
                                                                                              SecuriteInfo.com.Trojan.Nanocore.23.20965.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              SecuriteInfo.com.Mal.Generic-S.26042.exeGet hashmaliciousBrowse
                                                                                              • 172.67.143.180
                                                                                              trackinginfo#U007eupdate.jarGet hashmaliciousBrowse
                                                                                              • 104.20.23.46
                                                                                              trackinginfo#U007eupdate.jarGet hashmaliciousBrowse
                                                                                              • 104.20.22.46
                                                                                              MAL.PPTGet hashmaliciousBrowse
                                                                                              • 172.67.219.133

                                                                                              JA3 Fingerprints

                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                              3b5074b1b5d032e5620f69f9f700ff0eORDER.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              Mixtec New Order And Price List Requsting Form_pdf.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              swift copy.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              26-11-20_Dhl_Signed_document-pdf.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              Arrivalnotice2020pdf.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              SecuriteInfo.com.Mal.Generic-S.26042.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              guy1.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              guy2.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              Exodus.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              INV-6367-20_pdf.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              #A06578987.xlsmGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              Order 51897.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              PR24869408-V2.PDF.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              98650107.pdf.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              #U00d6deme Onay#U0131 Makbuzu.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              Izezma64.dllGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              fuxenm32.dllGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              http://ancien-site-joomla.fr/build2.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              yFD40YF4upaZQYL.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180
                                                                                              ER mexico.exeGet hashmaliciousBrowse
                                                                                              • 104.23.98.190
                                                                                              • 172.67.143.180

                                                                                              Dropped Files

                                                                                              No context

                                                                                              Created / dropped Files

                                                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Order.exe.log
                                                                                              Process:C:\Users\user\Desktop\Purchase Order.exe
                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                              Category:modified
                                                                                              Size (bytes):1308
                                                                                              Entropy (8bit):5.345811588615766
                                                                                              Encrypted:false
                                                                                              SSDEEP:24:MLU84qpE4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7GE4Kx1qE4KE4FsXE8:Mgv2HKXwYHKhQnoPtHoxHhAHKzvGHKxA
                                                                                              MD5:A4ADF61EEF553658F5C31E1C66E8B96D
                                                                                              SHA1:10F217A0097FF745454235C85DB2E9C01096AC7F
                                                                                              SHA-256:E9F51AE75A69A57A6CDE482C2B95F88E5C69728A0F4660C4C3A0374A440AC024
                                                                                              SHA-512:8D7F32714202122C8C698122FB3C981C3E2FA1A0FB12F761C5FB1BD33C67002FC3797F0E4DEB3DCBFA82F9C122B67A4FF0E42FBC4C97C00187E0AFC9E82AACD2
                                                                                              Malicious:true
                                                                                              Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutra
                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:data
                                                                                              Category:modified
                                                                                              Size (bytes):698
                                                                                              Entropy (8bit):5.049094101509586
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:reVGyMYx2Y5BYtmWNUc5AtYX5E4a2KryMYGH+ptsxptsOtw9O9S8:reUyMGF5ytmLcetYX5E2KryMb+zsxzsk
                                                                                              MD5:B0CEEA53B3467F59FD8E87F80213BDE9
                                                                                              SHA1:D9E6D1CBB480E7248658DF935648DFA733745602
                                                                                              SHA-256:D9C93CB64E6F1F5BDC94581CEEA99F759EE1E35716EAF623C61962EA0152F9DD
                                                                                              SHA-512:DDAA6C9FA3535B4926C60B692F8E202D10EB160D1F8BE7A9DE79239EF75AFD470403DF1D8F0CBF29A5F819E907D02E8E656BB9A52E71E30D9259987EAE881655
                                                                                              Malicious:false
                                                                                              Preview: PSMODULECACHE......w.e...a...C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Set-PackageSource........Unregister-PackageSource........Get-PackageSource........Install-Package........Save-Package........Get-Package........Find-Package........Install-PackageProvider........Import-PackageProvider........Get-PackageProvider........Register-PackageSource........Uninstall-Package........Find-PackageProvider........D..8.......C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psd1........Get-OperationValidation........Invoke-OperationValidation........
                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2g5p2lof.5bd.psm1
                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:very short file (no magic)
                                                                                              Category:dropped
                                                                                              Size (bytes):1
                                                                                              Entropy (8bit):0.0
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:U:U
                                                                                              MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                              SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                              SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                              SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                              Malicious:false
                                                                                              Preview: 1
                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3mnjijpy.0bm.ps1
                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:very short file (no magic)
                                                                                              Category:dropped
                                                                                              Size (bytes):1
                                                                                              Entropy (8bit):0.0
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:U:U
                                                                                              MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                              SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                              SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                              SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                              Malicious:false
                                                                                              Preview: 1
                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ilsjxgv4.chu.ps1
                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:very short file (no magic)
                                                                                              Category:dropped
                                                                                              Size (bytes):1
                                                                                              Entropy (8bit):0.0
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:U:U
                                                                                              MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                              SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                              SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                              SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                              Malicious:false
                                                                                              Preview: 1
                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n1dv2eqm.snp.psm1
                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:very short file (no magic)
                                                                                              Category:dropped
                                                                                              Size (bytes):1
                                                                                              Entropy (8bit):0.0
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:U:U
                                                                                              MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                              SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                              SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                              SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                              Malicious:false
                                                                                              Preview: 1
                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nrlm20hg.f3o.psm1
                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:very short file (no magic)
                                                                                              Category:dropped
                                                                                              Size (bytes):1
                                                                                              Entropy (8bit):0.0
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:U:U
                                                                                              MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                              SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                              SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                              SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                              Malicious:false
                                                                                              Preview: 1
                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ovek3yt1.yvg.psm1
                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:very short file (no magic)
                                                                                              Category:dropped
                                                                                              Size (bytes):1
                                                                                              Entropy (8bit):0.0
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:U:U
                                                                                              MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                              SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                              SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                              SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                              Malicious:false
                                                                                              Preview: 1
                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rfhy14t3.1da.ps1
                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:very short file (no magic)
                                                                                              Category:dropped
                                                                                              Size (bytes):1
                                                                                              Entropy (8bit):0.0
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:U:U
                                                                                              MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                              SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                              SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                              SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                              Malicious:false
                                                                                              Preview: 1
                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s4ufayo1.1u4.ps1
                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:very short file (no magic)
                                                                                              Category:dropped
                                                                                              Size (bytes):1
                                                                                              Entropy (8bit):0.0
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:U:U
                                                                                              MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                              SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                              SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                              SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                              Malicious:false
                                                                                              Preview: 1
                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe
                                                                                              Process:C:\Users\user\Desktop\Purchase Order.exe
                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):25072
                                                                                              Entropy (8bit):5.714293188808076
                                                                                              Encrypted:false
                                                                                              SSDEEP:384:LdlpJhbeGaNZ/JigmuuRU4FGcicdCfW81qttz7Dgf2hDT8MV:LdlxbF0KRUtfcdq0z7Uf2hcMV
                                                                                              MD5:596A39167153D9A5A4849D7B3A45BA58
                                                                                              SHA1:9F9F0A1D338200DFC3911E3CDDA5ACBEB6527FD3
                                                                                              SHA-256:656B086E8DCA8FC10F4527B417BE09A34CCE186FE1ADE61C38FE56775CC86E5B
                                                                                              SHA-512:FDA6A9B4358369FD49F06C674C44146C1BCD051F568EE69AA7E43B6D653E21DA626C5185159E0BF8973353D9C6552FF1E7DD1550E99DF5E4A5DC0EDC905A1973
                                                                                              Malicious:true
                                                                                              Antivirus:
                                                                                              • Antivirus: Virustotal, Detection: 30%, Browse
                                                                                              • Antivirus: ReversingLabs, Detection: 27%
                                                                                              Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>............"...0..@..........>_... ...`....@.. ..............................m.....`..................................^..K....`..8............N............................................................... ............... ..H............text...D?... ...@.................. ..`.rsrc...8....`.......B..............@..@.reloc...............L..............@..B................ _......H........;..T#..................P .......................................................................................................................................................................*. ....*.....90...(....9........r...p....(=...(3...*........(>...*....*..... ....`*..... ....`*.0..e........ .... ....(..... ....(..... ....(..... ....(..... ....(.........s....(....t........+...$.......o....o....s............o ...........o!............8........* ....* ....** ..
                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe:Zone.Identifier
                                                                                              Process:C:\Users\user\Desktop\Purchase Order.exe
                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):26
                                                                                              Entropy (8bit):3.95006375643621
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:ggPYV:rPYV
                                                                                              MD5:187F488E27DB4AF347237FE461A079AD
                                                                                              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                              Malicious:true
                                                                                              Preview: [ZoneTransfer]....ZoneId=0
                                                                                              C:\Users\user\Documents\20201127\PowerShell_transcript.367706.87+teOkT.20201127154838.txt
                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):960
                                                                                              Entropy (8bit):5.327838259776325
                                                                                              Encrypted:false
                                                                                              SSDEEP:24:BxSAvUxvBnJx2DOXUWeSutuVMdSWeHjeTKKjX4CIym1ZJX3RHdutuVMdG:BZvovhJoO+SEuGeqDYB1Z5RHdEuv
                                                                                              MD5:14D523A9D5E13A50EA0A9B8DC4BA1212
                                                                                              SHA1:5F77933F355E8149B5B5FEEC656ACADCBEC0FA89
                                                                                              SHA-256:BB8A0ABBA2DA57E404232A6238E83F86A093223C8A24D0FC9A332FA06D4E2CF6
                                                                                              SHA-512:82201B0B23AAD71E9A96D07B7A68208729FB70239F7256A75E1E77717BB4C7BE2D978E5D8CF3B21E061B3F1BC89603BFFF461E101E48AF06DA004626744550EF
                                                                                              Malicious:false
                                                                                              Preview: .**********************..Windows PowerShell transcript start..Start time: 20201127154928..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 367706 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe -Force..Process ID: 6156..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20201127154929..**********************..PS>Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe -Force..
                                                                                              C:\Users\user\Documents\20201127\PowerShell_transcript.367706.a6tVQ7J_.20201127154839.txt
                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):852
                                                                                              Entropy (8bit):5.305891665737362
                                                                                              Encrypted:false
                                                                                              SSDEEP:24:BxSAvEWAixvBnJx2DOXUWeSuXSWjHjeTKKjX4CIym1ZJX3WuXG:BZvEWAevhJoO+S0jqDYB1Z5WV
                                                                                              MD5:7F13526CF6FA14959A03FBCC02F20644
                                                                                              SHA1:0197DDB739C8251B6108E3868958EC358F5689D2
                                                                                              SHA-256:C9F66AE17305C0EA1E16D59A0FDE16A03B59F17B3E3BDE08B9D4D67F7F907074
                                                                                              SHA-512:F07510F0AD3CFD614068AB2BF7D890F7A7205D8CBFACD3FED72CF998CC47F028893C1601852A65BFA0F828A048DE1DD0BA426528CD1C7AC8892C950BED0009B3
                                                                                              Malicious:false
                                                                                              Preview: .**********************..Windows PowerShell transcript start..Start time: 20201127154927..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 367706 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\Desktop\Purchase Order.exe -Force..Process ID: 6320..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20201127154928..**********************..PS>Add-MpPreference -ExclusionPath C:\Users\user\Desktop\Purchase Order.exe -Force..
                                                                                              C:\Users\user\Documents\20201127\PowerShell_transcript.367706.kwApZ3uC.20201127154838.txt
                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):960
                                                                                              Entropy (8bit):5.320078934730475
                                                                                              Encrypted:false
                                                                                              SSDEEP:24:BxSAvR1xvBnJx2DOXUWeSutuVMdSWBHjeTKKjX4CIym1ZJX9VutuVMdG:BZvRHvhJoO+SEuGBqDYB1ZpEuv
                                                                                              MD5:17D92AD48F824C967619C9EEDEEAC26F
                                                                                              SHA1:B197E124B4175DD479A3193CD82BBBA8467E1E20
                                                                                              SHA-256:E20E2B4E96B1C1379AC66DE57BA1BEB8E502F10E1FC116A93CB17558FC647EFB
                                                                                              SHA-512:507DC23659C684F03EB36073B74450DAB6F06EDB20095998CAF8390554D19AD087F4C55663EA7E248766FD1D7808FF81D3FB1100E9EEC97F6609DD2A35347D4F
                                                                                              Malicious:false
                                                                                              Preview: .**********************..Windows PowerShell transcript start..Start time: 20201127154929..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 367706 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe -Force..Process ID: 6212..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20201127154932..**********************..PS>Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe -Force..
                                                                                              C:\Users\user\Documents\20201127\PowerShell_transcript.367706.yvGWKClR.20201127154836.txt
                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):959
                                                                                              Entropy (8bit):5.323567754108294
                                                                                              Encrypted:false
                                                                                              SSDEEP:24:BxSAvXmxvBnJx2DOXUWeSutuVMdSWNHjeTKKjX4CIym1ZJX3tutuVMdG:BZvXSvhJoO+SEuGNqDYB1Z5tEuv
                                                                                              MD5:A1E7791AEC11B317AFB5B293B48060DF
                                                                                              SHA1:CC84794CF2E804335114B82EF44FE096F626FDE4
                                                                                              SHA-256:18D8ADCFC5D8C7E9EF4C9169D328D22385C7593925565204BA496F4132826D89
                                                                                              SHA-512:D138BD9131C27A5CC05F68AFCEFCB1098E4F939F8F8E8A19FCD32E46D5E276423089BC481C551BBAF03DA98B8D396F9F09B9F483A70170480B8966313110A2C5
                                                                                              Malicious:false
                                                                                              Preview: .**********************..Windows PowerShell transcript start..Start time: 20201127154922..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 367706 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe -Force..Process ID: 852..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20201127154923..**********************..PS>Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe -Force..

                                                                                              Static File Info

                                                                                              General

                                                                                              File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                              Entropy (8bit):5.714293188808076
                                                                                              TrID:
                                                                                              • Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                                                                                              • Win32 Executable (generic) a (10002005/4) 49.97%
                                                                                              • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                              • DOS Executable Generic (2002/1) 0.01%
                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                              File name:Purchase Order.exe
                                                                                              File size:25072
                                                                                              MD5:596a39167153d9a5a4849d7b3a45ba58
                                                                                              SHA1:9f9f0a1d338200dfc3911e3cdda5acbeb6527fd3
                                                                                              SHA256:656b086e8dca8fc10f4527b417be09a34cce186fe1ade61c38fe56775cc86e5b
                                                                                              SHA512:fda6a9b4358369fd49f06c674c44146c1bcd051f568ee69aa7e43b6d653e21da626c5185159e0bf8973353d9c6552ff1e7dd1550e99df5e4a5dc0edc905a1973
                                                                                              SSDEEP:384:LdlpJhbeGaNZ/JigmuuRU4FGcicdCfW81qttz7Dgf2hDT8MV:LdlxbF0KRUtfcdq0z7Uf2hcMV
                                                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>............"...0..@..........>_... ...`....@.. ..............................m.....`................................

                                                                                              File Icon

                                                                                              Icon Hash:00828e8e8686b000

                                                                                              Static PE Info

                                                                                              General

                                                                                              Entrypoint:0x405f3e
                                                                                              Entrypoint Section:.text
                                                                                              Digitally signed:true
                                                                                              Imagebase:0x400000
                                                                                              Subsystem:windows gui
                                                                                              Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                              DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
                                                                                              Time Stamp:0xCBFB3E96 [Sun Jun 12 06:20:06 2078 UTC]
                                                                                              TLS Callbacks:
                                                                                              CLR (.Net) Version:v4.0.30319
                                                                                              OS Version Major:4
                                                                                              OS Version Minor:0
                                                                                              File Version Major:4
                                                                                              File Version Minor:0
                                                                                              Subsystem Version Major:4
                                                                                              Subsystem Version Minor:0
                                                                                              Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                              Authenticode Signature

                                                                                              Signature Valid:false
                                                                                              Signature Issuer:C=US, L=New York, OU=Bbcfbefdbb, O=Dffcefbadefcdcecfddcacffadfed, CN=Afaadcaabfdacfebbae
                                                                                              Signature Validation Error:A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
                                                                                              Error Number:-2146762487
                                                                                              Not Before, Not After
                                                                                              • 11/26/2020 9:53:11 PM 11/26/2021 9:53:11 PM
                                                                                              Subject Chain
                                                                                              • C=US, L=New York, OU=Bbcfbefdbb, O=Dffcefbadefcdcecfddcacffadfed, CN=Afaadcaabfdacfebbae
                                                                                              Version:3
                                                                                              Thumbprint MD5:DF6D72A772F57B36E9503B8297458C66
                                                                                              Thumbprint SHA-1:CCBAE23D2E00F06ABFBC713DBF2AE146264E9437
                                                                                              Thumbprint SHA-256:E3BE330F25F69E38EC727C56ECD1F50B42B44B4DD1112D3077CA0F056981E210
                                                                                              Serial:728A31362530BF418730565CED05D413

                                                                                              Entrypoint Preview

                                                                                              Instruction
                                                                                              jmp dword ptr [00402000h]
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al

                                                                                              Data Directories

                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x5ef00x4b.text
                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x60000x938.rsrc
                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x4e000x13f0
                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x80000xc.reloc
                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                              Sections

                                                                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                              .text0x20000x3f440x4000False0.402770996094data5.28418254913IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                              .rsrc0x60000x9380xa00False0.4data4.53088923142IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                              .reloc0x80000xc0x200False0.044921875data0.0815394123432IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                              Resources

                                                                                              NameRVASizeTypeLanguageCountry
                                                                                              RT_VERSION0x60a00x3fcdata
                                                                                              RT_MANIFEST0x649c0x49aXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                                                              Imports

                                                                                              DLLImport
                                                                                              mscoree.dll_CorExeMain

                                                                                              Version Infos

                                                                                              DescriptionData
                                                                                              Translation0x0000 0x04b0
                                                                                              LegalCopyright Microsoft Corporation. All rights reserved.
                                                                                              Assembly Version2.0.0.0
                                                                                              InternalNameServiceHub.Host.CLR.exe
                                                                                              FileVersion2.4.227.2020
                                                                                              CompanyNameMicrosoft
                                                                                              CommentsMicrosoft Service Hub (AnyCPU) CLR host
                                                                                              ProductNameServiceHub.Host.CLR
                                                                                              ProductVersion2.4.227+e4076a6e7d.RR
                                                                                              FileDescriptionServiceHub.Host.CLR
                                                                                              OriginalFilenameServiceHub.Host.CLR.exe

                                                                                              Network Behavior

                                                                                              Network Port Distribution

                                                                                              TCP Packets

                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                              Nov 27, 2020 15:47:23.323806047 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.351280928 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.351506948 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.413367987 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.440412998 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.443201065 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.443234921 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.443382978 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.460927963 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.488065958 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.488241911 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.545090914 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.559590101 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.586739063 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.767745018 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.767797947 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.767828941 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.767870903 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.767910004 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.767952919 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.767959118 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.767997980 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.768038988 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.768070936 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.768100977 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.768121004 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.768130064 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.768167973 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.768191099 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.768207073 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.768235922 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.768235922 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.768275023 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.768312931 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.768341064 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.768357992 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.768424988 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.841567993 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841595888 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841612101 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841628075 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841655016 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841672897 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841687918 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841696978 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841711998 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841731071 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841742039 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.841747999 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841761112 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841773987 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.841778994 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841797113 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841814995 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841830015 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841845036 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841864109 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841875076 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.841891050 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.842011929 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.842055082 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.842073917 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.842092991 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.842113972 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.842130899 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.842147112 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.842147112 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.842164993 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.842180014 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.842205048 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.842274904 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.914504051 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.914576054 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.914608002 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.914638996 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.914666891 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.914696932 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.914736032 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.914773941 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.914803028 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.914844036 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.914880991 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.914916039 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.915028095 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.915112972 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.917457104 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.917499065 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.917536974 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.917571068 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.917607069 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.917646885 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.917664051 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.917685032 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.917685032 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.917726040 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.917763948 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.917768002 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.917807102 CET44349724172.67.143.180192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.917821884 CET49724443192.168.2.3172.67.143.180
                                                                                              Nov 27, 2020 15:47:23.917845964 CET44349724172.67.143.180192.168.2.3

                                                                                              UDP Packets

                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                              Nov 27, 2020 15:47:11.863152981 CET5319553192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:11.898602962 CET53531958.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:12.710366964 CET5014153192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:12.746022940 CET53501418.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:14.135226011 CET5302353192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:14.162338972 CET53530238.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:15.038717985 CET4956353192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:15.065820932 CET53495638.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:16.095932007 CET5135253192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:16.123070955 CET53513528.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:18.782953978 CET5934953192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:18.810156107 CET53593498.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:20.540648937 CET5708453192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:20.576370955 CET53570848.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:21.445425034 CET5882353192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:21.481271982 CET53588238.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:22.261267900 CET5756853192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:22.297020912 CET53575688.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.204736948 CET5054053192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:23.232091904 CET53505408.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:23.253607035 CET5436653192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:23.299099922 CET53543668.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:24.600744963 CET5303453192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:24.627765894 CET53530348.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:25.602063894 CET5776253192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:25.637801886 CET53577628.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:39.681377888 CET5543553192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:39.708642960 CET53554358.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:42.156944990 CET5071353192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:42.194050074 CET53507138.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:44.968666077 CET5613253192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:45.009474039 CET53561328.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:47:48.073542118 CET5898753192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:47:48.109239101 CET53589878.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:09.049117088 CET5657953192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:09.259449959 CET53565798.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:09.850470066 CET6063353192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:09.894376040 CET53606338.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:10.637584925 CET6129253192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:10.673576117 CET53612928.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:12.222543001 CET6361953192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:12.257970095 CET53636198.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:13.146755934 CET6493853192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:13.182246923 CET53649388.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:14.928518057 CET6194653192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:14.964061975 CET53619468.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:15.736129045 CET6491053192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:15.771245956 CET53649108.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:17.180139065 CET5212353192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:17.215616941 CET53521238.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:20.876672983 CET5613053192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:20.912143946 CET53561308.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:23.026216030 CET5633853192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:23.061911106 CET53563388.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:23.271158934 CET5942053192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:23.307945967 CET53594208.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:24.952840090 CET5878453192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:24.988629103 CET53587848.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:28.451050997 CET6397853192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:28.486440897 CET53639788.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:36.006021023 CET6293853192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:36.041603088 CET53629388.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:38.360218048 CET5570853192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:38.396245003 CET53557088.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:39.395433903 CET5680353192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:39.432951927 CET53568038.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:47.852437019 CET5714553192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:47.887856007 CET53571458.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:54.362910986 CET5535953192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:54.390121937 CET53553598.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:55.839361906 CET5535953192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:55.866420984 CET53553598.8.8.8192.168.2.3
                                                                                              Nov 27, 2020 15:48:59.269279003 CET5830653192.168.2.38.8.8.8
                                                                                              Nov 27, 2020 15:48:59.313206911 CET53583068.8.8.8192.168.2.3

                                                                                              DNS Queries

                                                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                              Nov 27, 2020 15:47:23.253607035 CET192.168.2.38.8.8.80x3f40Standard query (0)hastebin.comA (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:47:48.073542118 CET192.168.2.38.8.8.80xfe1aStandard query (0)pastebin.comA (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:28.451050997 CET192.168.2.38.8.8.80x5944Standard query (0)hastebin.comA (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:36.006021023 CET192.168.2.38.8.8.80xcbe4Standard query (0)hastebin.comA (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:38.360218048 CET192.168.2.38.8.8.80x600bStandard query (0)hastebin.comA (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:39.395433903 CET192.168.2.38.8.8.80x810cStandard query (0)hastebin.comA (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:47.852437019 CET192.168.2.38.8.8.80xcbc4Standard query (0)pastebin.comA (IP address)IN (0x0001)

                                                                                              DNS Answers

                                                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                              Nov 27, 2020 15:47:23.299099922 CET8.8.8.8192.168.2.30x3f40No error (0)hastebin.com172.67.143.180A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:47:23.299099922 CET8.8.8.8192.168.2.30x3f40No error (0)hastebin.com104.24.126.89A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:47:23.299099922 CET8.8.8.8192.168.2.30x3f40No error (0)hastebin.com104.24.127.89A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:47:48.109239101 CET8.8.8.8192.168.2.30xfe1aNo error (0)pastebin.com104.23.98.190A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:47:48.109239101 CET8.8.8.8192.168.2.30xfe1aNo error (0)pastebin.com104.23.99.190A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:28.486440897 CET8.8.8.8192.168.2.30x5944No error (0)hastebin.com172.67.143.180A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:28.486440897 CET8.8.8.8192.168.2.30x5944No error (0)hastebin.com104.24.126.89A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:28.486440897 CET8.8.8.8192.168.2.30x5944No error (0)hastebin.com104.24.127.89A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:36.041603088 CET8.8.8.8192.168.2.30xcbe4No error (0)hastebin.com172.67.143.180A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:36.041603088 CET8.8.8.8192.168.2.30xcbe4No error (0)hastebin.com104.24.126.89A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:36.041603088 CET8.8.8.8192.168.2.30xcbe4No error (0)hastebin.com104.24.127.89A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:38.396245003 CET8.8.8.8192.168.2.30x600bNo error (0)hastebin.com172.67.143.180A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:38.396245003 CET8.8.8.8192.168.2.30x600bNo error (0)hastebin.com104.24.126.89A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:38.396245003 CET8.8.8.8192.168.2.30x600bNo error (0)hastebin.com104.24.127.89A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:39.432951927 CET8.8.8.8192.168.2.30x810cNo error (0)hastebin.com172.67.143.180A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:39.432951927 CET8.8.8.8192.168.2.30x810cNo error (0)hastebin.com104.24.126.89A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:39.432951927 CET8.8.8.8192.168.2.30x810cNo error (0)hastebin.com104.24.127.89A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:47.887856007 CET8.8.8.8192.168.2.30xcbc4No error (0)pastebin.com104.23.99.190A (IP address)IN (0x0001)
                                                                                              Nov 27, 2020 15:48:47.887856007 CET8.8.8.8192.168.2.30xcbc4No error (0)pastebin.com104.23.98.190A (IP address)IN (0x0001)

                                                                                              HTTPS Packets

                                                                                              TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                                                                              Nov 27, 2020 15:47:23.443234921 CET172.67.143.180443192.168.2.349724CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=USCN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IESat Jul 25 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020Sun Jul 25 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,03b5074b1b5d032e5620f69f9f700ff0e
                                                                                              CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=USCN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IEMon Jan 27 13:48:08 CET 2020Wed Jan 01 00:59:59 CET 2025

                                                                                              Code Manipulations

                                                                                              Statistics

                                                                                              Behavior

                                                                                              Click to jump to process

                                                                                              System Behavior

                                                                                              Analysis Process: Purchase Order.exe PID: 2100 Parent PID: 5820

                                                                                              General

                                                                                              Start time:15:48:04
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Users\user\Desktop\Purchase Order.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:'C:\Users\user\Desktop\Purchase Order.exe'
                                                                                              Imagebase:0x360000
                                                                                              File size:25072 bytes
                                                                                              MD5 hash:596A39167153D9A5A4849D7B3A45BA58
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:.Net C# or VB.NET
                                                                                              Reputation:low

                                                                                              Analysis Process: timeout.exe PID: 5996 Parent PID: 2100

                                                                                              General

                                                                                              Start time:15:48:05
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\SysWOW64\timeout.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:timeout 4
                                                                                              Imagebase:0xd50000
                                                                                              File size:26112 bytes
                                                                                              MD5 hash:121A4EDAE60A7AF6F5DFA82F7BB95659
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high

                                                                                              Analysis Process: conhost.exe PID: 5476 Parent PID: 5996

                                                                                              General

                                                                                              Start time:15:48:05
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              Imagebase:0x7ff6b2800000
                                                                                              File size:625664 bytes
                                                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high

                                                                                              Analysis Process: powershell.exe PID: 852 Parent PID: 2100

                                                                                              General

                                                                                              Start time:15:48:33
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
                                                                                              Imagebase:0xb10000
                                                                                              File size:430592 bytes
                                                                                              MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:.Net C# or VB.NET
                                                                                              Reputation:high

                                                                                              Analysis Process: conhost.exe PID: 1124 Parent PID: 852

                                                                                              General

                                                                                              Start time:15:48:34
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              Imagebase:0x7ff6b2800000
                                                                                              File size:625664 bytes
                                                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high

                                                                                              Analysis Process: powershell.exe PID: 6156 Parent PID: 2100

                                                                                              General

                                                                                              Start time:15:48:34
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
                                                                                              Imagebase:0xb10000
                                                                                              File size:430592 bytes
                                                                                              MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:.Net C# or VB.NET
                                                                                              Reputation:high

                                                                                              Analysis Process: powershell.exe PID: 6212 Parent PID: 2100

                                                                                              General

                                                                                              Start time:15:48:34
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purchase Order.exe' -Force
                                                                                              Imagebase:0xb10000
                                                                                              File size:430592 bytes
                                                                                              MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:.Net C# or VB.NET
                                                                                              Reputation:high

                                                                                              Analysis Process: conhost.exe PID: 6220 Parent PID: 6156

                                                                                              General

                                                                                              Start time:15:48:34
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              Imagebase:0x7ff6b2800000
                                                                                              File size:625664 bytes
                                                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high

                                                                                              Analysis Process: conhost.exe PID: 6260 Parent PID: 6212

                                                                                              General

                                                                                              Start time:15:48:35
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              Imagebase:0x7ff6b2800000
                                                                                              File size:625664 bytes
                                                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high

                                                                                              Analysis Process: powershell.exe PID: 6320 Parent PID: 2100

                                                                                              General

                                                                                              Start time:15:48:35
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Purchase Order.exe' -Force
                                                                                              Imagebase:0xb10000
                                                                                              File size:430592 bytes
                                                                                              MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:.Net C# or VB.NET
                                                                                              Reputation:high

                                                                                              Analysis Process: conhost.exe PID: 6396 Parent PID: 6320

                                                                                              General

                                                                                              Start time:15:48:35
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              Imagebase:0x7ff6b2800000
                                                                                              File size:625664 bytes
                                                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high

                                                                                              Analysis Process: Purchase Order.exe PID: 7156 Parent PID: 2100

                                                                                              General

                                                                                              Start time:15:48:44
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Users\user\Desktop\Purchase Order.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:C:\Users\user\Desktop\Purchase Order.exe
                                                                                              Imagebase:0xc90000
                                                                                              File size:25072 bytes
                                                                                              MD5 hash:596A39167153D9A5A4849D7B3A45BA58
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:.Net C# or VB.NET
                                                                                              Yara matches:
                                                                                              • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000018.00000002.411043427.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000018.00000002.429643390.0000000002F91000.00000004.00000001.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000002.429643390.0000000002F91000.00000004.00000001.sdmp, Author: Joe Security

                                                                                              Analysis Process: Purchase Order.exe PID: 1752 Parent PID: 3388

                                                                                              General

                                                                                              Start time:15:48:45
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Users\user\Desktop\Purchase Order.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:'C:\Users\user\Desktop\Purchase Order.exe'
                                                                                              Imagebase:0xd80000
                                                                                              File size:25072 bytes
                                                                                              MD5 hash:596A39167153D9A5A4849D7B3A45BA58
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:.Net C# or VB.NET

                                                                                              Analysis Process: timeout.exe PID: 1328 Parent PID: 1752

                                                                                              General

                                                                                              Start time:15:48:47
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\SysWOW64\timeout.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:timeout 4
                                                                                              Imagebase:0xd50000
                                                                                              File size:26112 bytes
                                                                                              MD5 hash:121A4EDAE60A7AF6F5DFA82F7BB95659
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              Analysis Process: conhost.exe PID: 1256 Parent PID: 1328

                                                                                              General

                                                                                              Start time:15:48:47
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              Imagebase:0x7ff7488e0000
                                                                                              File size:625664 bytes
                                                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              Analysis Process: Purchase Order.exe PID: 5244 Parent PID: 3388

                                                                                              General

                                                                                              Start time:15:48:54
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Users\user\Desktop\Purchase Order.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:'C:\Users\user\Desktop\Purchase Order.exe'
                                                                                              Imagebase:0x730000
                                                                                              File size:25072 bytes
                                                                                              MD5 hash:596A39167153D9A5A4849D7B3A45BA58
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:.Net C# or VB.NET

                                                                                              Analysis Process: timeout.exe PID: 7136 Parent PID: 5244

                                                                                              General

                                                                                              Start time:15:48:57
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\SysWOW64\timeout.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:timeout 4
                                                                                              Imagebase:0xd50000
                                                                                              File size:26112 bytes
                                                                                              MD5 hash:121A4EDAE60A7AF6F5DFA82F7BB95659
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              Analysis Process: conhost.exe PID: 5792 Parent PID: 7136

                                                                                              General

                                                                                              Start time:15:48:58
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              Imagebase:0x7ff6b2800000
                                                                                              File size:625664 bytes
                                                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              Analysis Process: Purchase Order.exe PID: 4660 Parent PID: 3388

                                                                                              General

                                                                                              Start time:15:49:04
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Users\user\Desktop\Purchase Order.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:'C:\Users\user\Desktop\Purchase Order.exe'
                                                                                              Imagebase:0xa90000
                                                                                              File size:25072 bytes
                                                                                              MD5 hash:596A39167153D9A5A4849D7B3A45BA58
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:.Net C# or VB.NET

                                                                                              Analysis Process: timeout.exe PID: 5860 Parent PID: 4660

                                                                                              General

                                                                                              Start time:15:49:06
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\SysWOW64\timeout.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:timeout 4
                                                                                              Imagebase:0xd50000
                                                                                              File size:26112 bytes
                                                                                              MD5 hash:121A4EDAE60A7AF6F5DFA82F7BB95659
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              Analysis Process: conhost.exe PID: 5228 Parent PID: 5860

                                                                                              General

                                                                                              Start time:15:49:07
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              Imagebase:0x7ff6b2800000
                                                                                              File size:625664 bytes
                                                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              Analysis Process: Purchase Order.exe PID: 5268 Parent PID: 3388

                                                                                              General

                                                                                              Start time:15:49:13
                                                                                              Start date:27/11/2020
                                                                                              Path:C:\Users\user\Desktop\Purchase Order.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:'C:\Users\user\Desktop\Purchase Order.exe'
                                                                                              Imagebase:0xe10000
                                                                                              File size:25072 bytes
                                                                                              MD5 hash:596A39167153D9A5A4849D7B3A45BA58
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:.Net C# or VB.NET

                                                                                              Disassembly

                                                                                              Code Analysis

                                                                                              Reset < >