Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report shipping documents for PO#813-25319 192-463-56-265-3327.exe

Overview

General Information

Sample Name:shipping documents for PO#813-25319 192-463-56-265-3327.exe
Analysis ID:433447
MD5:1b323fcf40192afd8c2d85acca658e7c
SHA1:57b9c62162a645602e8eb059272bbb8bfcff8d67
SHA256:2ebf28b25bd92fcb406458cae714c8740a3fa162e664ec66b404c06990bb5d5f
Tags:exe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains very large array initializations
.NET source code contains very large strings
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "sales1@ashtavinayaka.com123456789smtpout.secureserver.net"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
          0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 9 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 5 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmpMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "sales1@ashtavinayaka.com123456789smtpout.secureserver.net"}
                      Multi AV Scanner detection for dropped fileShow sources
                      Source: C:\Users\user\AppData\Roaming\NkYArXVCGCJ.exeReversingLabs: Detection: 23%
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exeReversingLabs: Detection: 23%
                      Machine Learning detection for dropped fileShow sources
                      Source: C:\Users\user\AppData\Roaming\NkYArXVCGCJ.exeJoe Sandbox ML: detected
                      Machine Learning detection for sampleShow sources
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exeJoe Sandbox ML: detected
                      Source: 11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmpString found in binary or memory: http://kqfOpU.com
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286861757.0000000002EB1000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b92C625F0u002dCB9Cu002d42BAu002d9B29u002d09C40FFF2B0Bu007d/C9292A3Cu002d0320u002d42D4u002d932Fu002d56A5FC9F4AD5.csLarge array initialization: .cctor: array initializer size 11943
                      Source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007b92C625F0u002dCB9Cu002d42BAu002d9B29u002d09C40FFF2B0Bu007d/C9292A3Cu002d0320u002d42D4u002d932Fu002d56A5FC9F4AD5.csLarge array initialization: .cctor: array initializer size 11943
                      .NET source code contains very large stringsShow sources
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, TopdownDll/Form1.csLong String: Length: 11840
                      Source: NkYArXVCGCJ.exe.0.dr, TopdownDll/Form1.csLong String: Length: 11840
                      Source: 0.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.900000.0.unpack, TopdownDll/Form1.csLong String: Length: 11840
                      Source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.900000.0.unpack, TopdownDll/Form1.csLong String: Length: 11840
                      Source: 9.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.150000.0.unpack, TopdownDll/Form1.csLong String: Length: 11840
                      Source: 9.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.150000.0.unpack, TopdownDll/Form1.csLong String: Length: 11840
                      Source: 11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.650000.1.unpack, TopdownDll/Form1.csLong String: Length: 11840
                      Source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.650000.0.unpack, TopdownDll/Form1.csLong String: Length: 11840
                      Source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.650000.2.unpack, TopdownDll/Form1.csLong String: Length: 11840
                      Executable has a suspicious name (potential lure to open the executable)Show sources
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exeStatic file information: Suspicious name
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: initial sampleStatic PE information: Filename: shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeCode function: 0_2_07AD07B0
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeCode function: 0_2_07AD1680
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeCode function: 0_2_07A809C3
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeCode function: 0_2_07AD37C0
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeCode function: 0_2_07AD25D8
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeCode function: 0_2_07AD3150
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeCode function: 0_2_07AD3C90
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeCode function: 0_2_07AD3A30
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeCode function: 0_2_07AD3E70
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeCode function: 0_2_07AD3450
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeCode function: 0_2_02C8C1D4
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeCode function: 0_2_02C8E620
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeCode function: 0_2_02C8E630
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exeBinary or memory string: OriginalFilename vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNpXVsfKmoYCvTOuLtBSSAxQUjXePN.exe4 vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.295311252.0000000007A50000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMajorRevision.exe< vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.285511609.0000000000902000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamevJdJ.exe6 vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286471938.0000000002C00000.00000002.00000001.sdmpBinary or memory string: originalfilename vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286471938.0000000002C00000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286861757.0000000002EB1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameWindowsNetwork.dll> vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.295893809.000000000D260000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.295043203.0000000007880000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exeBinary or memory string: OriginalFilename vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000009.00000002.283414812.0000000000152000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamevJdJ.exe6 vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exeBinary or memory string: OriginalFilename vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000000.284386569.0000000000652000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamevJdJ.exe6 vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameNpXVsfKmoYCvTOuLtBSSAxQUjXePN.exe4 vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exeBinary or memory string: OriginalFilenamevJdJ.exe6 vs shipping documents for PO#813-25319 192-463-56-265-3327.exe
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: NkYArXVCGCJ.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, TopdownDll/Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: NkYArXVCGCJ.exe.0.dr, TopdownDll/Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 0.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.900000.0.unpack, TopdownDll/Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.900000.0.unpack, TopdownDll/Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 9.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.150000.0.unpack, TopdownDll/Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 9.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.150000.0.unpack, TopdownDll/Form1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: classification engineClassification label: mal100.troj.evad.winEXE@8/3@0/0
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeFile created: C:\Users\user\AppData\Roaming\NkYArXVCGCJ.exeJump to behavior
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5092:120:WilError_01
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeMutant created: \Sessions\1\BaseNamedObjects\dOyOVVv
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeFile created: C:\Users\user\AppData\Local\Temp\tmp4F70.tmpJump to behavior
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exeReversingLabs: Detection: 23%
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeFile read: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe 'C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe'
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NkYArXVCGCJ' /XML 'C:\Users\user\AppData\Local\Temp\tmp4F70.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess created: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe {path}
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess created: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe {path}
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NkYArXVCGCJ' /XML 'C:\Users\user\AppData\Local\Temp\tmp4F70.tmp'
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess created: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe {path}
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess created: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe {path}
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeCode function: 0_2_02C87F48 pushfd ; retf
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.77523245185
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.77523245185
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeFile created: C:\Users\user\AppData\Roaming\NkYArXVCGCJ.exeJump to dropped file

                      Boot Survival:

                      barindex
                      Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NkYArXVCGCJ' /XML 'C:\Users\user\AppData\Local\Temp\tmp4F70.tmp'
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 6452, type: MEMORY
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeWindow / User API: threadDelayed 5074
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeWindow / User API: threadDelayed 4743
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe TID: 6488Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe TID: 6108Thread sleep time: -18446744073709540s >= -30000s
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe TID: 6128Thread sleep count: 5074 > 30
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe TID: 6128Thread sleep count: 4743 > 30
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeThread delayed: delay time: 922337203685477
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmpBinary or memory string: VMWARE
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286915009.0000000002F07000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess information queried: ProcessInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeMemory allocated: page read and write | page guard

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeMemory written: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe base: 400000 value starts with: 4D5A
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NkYArXVCGCJ' /XML 'C:\Users\user\AppData\Local\Temp\tmp4F70.tmp'
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess created: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe {path}
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeProcess created: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe {path}
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469142924.00000000014C0000.00000002.00000001.sdmpBinary or memory string: Program Manager
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469142924.00000000014C0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469142924.00000000014C0000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469142924.00000000014C0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                      Source: C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.288101589.000000000404D000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.41347e0.5.raw.unpack, type: UNPACKEDPE
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.288101589.000000000404D000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 5736, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 6452, type: MEMORY
                      Source: Yara matchFile source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.41347e0.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 5736, type: MEMORY

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.288101589.000000000404D000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.41347e0.5.raw.unpack, type: UNPACKEDPE
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.288101589.000000000404D000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 5736, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 6452, type: MEMORY
                      Source: Yara matchFile source: 11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.3f81588.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.41347e0.5.raw.unpack, type: UNPACKEDPE

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211Scheduled Task/Job1Process Injection112Masquerading1OS Credential DumpingSecurity Software Discovery321Remote ServicesArchive Collected Data11Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/Job1Boot or Logon Initialization ScriptsScheduled Task/Job1Disable or Modify Tools1LSASS MemoryProcess Discovery2Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion141Security Account ManagerVirtualization/Sandbox Evasion141SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection112NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsFile and Directory Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information2Cached Domain CredentialsSystem Information Discovery113VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing3DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      shipping documents for PO#813-25319 192-463-56-265-3327.exe24%ReversingLabsByteCode-MSIL.Trojan.AgentTesla
                      shipping documents for PO#813-25319 192-463-56-265-3327.exe100%Joe Sandbox ML

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\Users\user\AppData\Roaming\NkYArXVCGCJ.exe100%Joe Sandbox ML
                      C:\Users\user\AppData\Roaming\NkYArXVCGCJ.exe24%ReversingLabsByteCode-MSIL.Trojan.AgentTesla

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      11.2.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File
                      11.0.shipping documents for PO#813-25319 192-463-56-265-3327.exe.400000.1.unpack100%AviraTR/Spy.Gen8Download File

                      Domains

                      No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      http://kqfOpU.com0%Avira URL Cloudsafe

                      Domains and IPs

                      Contacted Domains

                      No contacted domains info

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://127.0.0.1:HTTP/1.1shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		low
                      http://www.apache.org/licenses/LICENSE-2.0shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                        		high
                        http://www.fontbureau.comshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                          		high
                          http://www.fontbureau.com/designersGshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                            		high
                            http://DynDns.comDynDNSshipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.com/designers/?shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                              		high
                              http://www.founder.com.cn/cn/bTheshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%hashipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.com/designers?shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                		high
                                http://www.tiro.comshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designersshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                  		high
                                  http://www.goodfont.co.krshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.carterandcone.comlshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.sajatypeworks.comshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.typography.netDshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.com/designers/cabarga.htmlNshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                    		high
                                    http://www.founder.com.cn/cn/cTheshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.galapagosdesign.com/staff/dennis.htmshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://fontfabrik.comshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.founder.com.cn/cnshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.com/designers/frere-jones.htmlshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                      		high
                                      http://www.jiyu-kobo.co.jp/shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.galapagosdesign.com/DPleaseshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.com/designers8shipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                        		high
                                        http://www.fonts.comshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                          		high
                                          http://www.sandoll.co.krshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.urwpp.deDPleaseshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.zhongyicts.com.cnshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.286861757.0000000002EB1000.00000004.00000001.sdmpfalse
                                            		high
                                            http://www.sakkal.comshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.291994588.0000000005DA0000.00000002.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            		unknown
                                            https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipshipping documents for PO#813-25319 192-463-56-265-3327.exe, 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, shipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            		unknown
                                            http://kqfOpU.comshipping documents for PO#813-25319 192-463-56-265-3327.exe, 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown

                                            Contacted IPs

                                            No contacted IP infos

                                            General Information

                                            Joe Sandbox Version:32.0.0 Black Diamond
                                            Analysis ID:433447
                                            Start date:11.06.2021
                                            Start time:21:11:13
                                            Joe Sandbox Product:CloudBasic
                                            Overall analysis duration:0h 8m 21s
                                            Hypervisor based Inspection enabled:false
                                            Report type:light
                                            Sample file name:shipping documents for PO#813-25319 192-463-56-265-3327.exe
                                            Cookbook file name:default.jbs
                                            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                            Number of analysed new started processes analysed:29
                                            Number of new started drivers analysed:0
                                            Number of existing processes analysed:0
                                            Number of existing drivers analysed:0
                                            Number of injected processes analysed:0
                                            Technologies:
                                            • HCA enabled
                                            • EGA enabled
                                            • HDC enabled
                                            • AMSI enabled
                                            Analysis Mode:default
                                            Analysis stop reason:Timeout
                                            Detection:MAL
                                            Classification:mal100.troj.evad.winEXE@8/3@0/0
                                            EGA Information:Failed
                                            HDC Information:
                                            • Successful, ratio: 0.2% (good quality ratio 0.1%)
                                            • Quality average: 61.6%
                                            • Quality standard deviation: 33.1%
                                            HCA Information:
                                            • Successful, ratio: 97%
                                            • Number of executed functions: 0
                                            • Number of non-executed functions: 0
                                            Cookbook Comments:
                                            • Adjust boot time
                                            • Enable AMSI
                                            • Found application associated with file extension: .exe
                                            Warnings:
                                            Show All
                                            • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
                                            • Not all processes where analyzed, report is missing behavior information
                                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                            • Report size getting too big, too many NtQueryValueKey calls found.

                                            Simulations

                                            Behavior and APIs

                                            TimeTypeDescription
                                            21:12:50API Interceptor571x Sleep call for process: shipping documents for PO#813-25319 192-463-56-265-3327.exe modified

                                            Joe Sandbox View / Context

                                            IPs

                                            No context

                                            Domains

                                            No context

                                            ASN

                                            No context

                                            JA3 Fingerprints

                                            No context

                                            Dropped Files

                                            No context

                                            Created / dropped Files

                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\shipping documents for PO#813-25319 192-463-56-265-3327.exe.log
                                            Process:C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe
                                            File Type:ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):1216
                                            Entropy (8bit):5.355304211458859
                                            Encrypted:false
                                            SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
                                            MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                            SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                            SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                            SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                            Malicious:true
                                            Reputation:high, very likely benign file
                                            Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21
                                            C:\Users\user\AppData\Local\Temp\tmp4F70.tmp
                                            Process:C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe
                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):1644
                                            Entropy (8bit):5.206057226052344
                                            Encrypted:false
                                            SSDEEP:24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBto0tn:cbh47TlNQ//rydbz9I3YODOLNdq3j
                                            MD5:7B73EF087D2C095531D38AC617ECE4A4
                                            SHA1:D7B8B661A43DDF2681E31E5C999661D9FB80C0B8
                                            SHA-256:DC475B27B0F42A49B627BCF66ED7A933B2BAA4198F312AE041DF234FB10C6F4E
                                            SHA-512:6B5C89EB068C9915CCDEC28C1A69867830EB91A83CA1919FED96C2A885BF202B50B95DEF577EC6D792ACC03EB4384FA4FFF11806ED3CC185897A5C32D9618D67
                                            Malicious:true
                                            Reputation:low
                                            Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true
                                            C:\Users\user\AppData\Roaming\NkYArXVCGCJ.exe
                                            Process:C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe
                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                            Category:dropped
                                            Size (bytes):452096
                                            Entropy (8bit):7.761846193878433
                                            Encrypted:false
                                            SSDEEP:6144:zq0f9rlcph/61jE7pGczlztrJ4ZU/yJq8EIGNv7kZ1G/G1b68anUtAMH+3ZrqP:zqu9Gph/61k/zlNHZIgv7kq8yUJHmS
                                            MD5:1B323FCF40192AFD8C2D85ACCA658E7C
                                            SHA1:57B9C62162A645602E8EB059272BBB8BFCFF8D67
                                            SHA-256:2EBF28B25BD92FCB406458CAE714C8740A3FA162E664EC66B404C06990BB5D5F
                                            SHA-512:B9B731DE239467D7593FD20954F07AA028C7E2AEA8EF0E88891C309EEE70D35E3EEF15C05D8EDB92ED2F6573F36E210AB4070A7FAB80BDE8E21C831CACEF8E84
                                            Malicious:true
                                            Antivirus:
                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                            • Antivirus: ReversingLabs, Detection: 24%
                                            Reputation:low
                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............0.............v.... ........@.. .......................@............@.................................$...O............................ ....................................................... ............... ..H............text...|.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................X.......H.................._....r...............................................0............{.....+..*..*".(.....*".(.....*....0.................,.s....z*&..(.....*........s................s................s.........*..0..]........~..............,?.~..........(......~..............,..(...+..........,..(.......~......+...*...........*E.......s.........*.0...........~.....+..*..0..P........~..........(......~.........,..s............ .~....r...po..........,..(.......*........:C......

                                            Static File Info

                                            General

                                            File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                            Entropy (8bit):7.761846193878433
                                            TrID:
                                            • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                            • Win32 Executable (generic) a (10002005/4) 49.78%
                                            • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                            • Generic Win/DOS Executable (2004/3) 0.01%
                                            • DOS Executable Generic (2002/1) 0.01%
                                            File name:shipping documents for PO#813-25319 192-463-56-265-3327.exe
                                            File size:452096
                                            MD5:1b323fcf40192afd8c2d85acca658e7c
                                            SHA1:57b9c62162a645602e8eb059272bbb8bfcff8d67
                                            SHA256:2ebf28b25bd92fcb406458cae714c8740a3fa162e664ec66b404c06990bb5d5f
                                            SHA512:b9b731de239467d7593fd20954f07aa028c7e2aea8ef0e88891c309eee70d35e3eef15c05d8edb92ed2f6573f36e210ab4070a7fab80bde8e21c831cacef8e84
                                            SSDEEP:6144:zq0f9rlcph/61jE7pGczlztrJ4ZU/yJq8EIGNv7kZ1G/G1b68anUtAMH+3ZrqP:zqu9Gph/61k/zlNHZIgv7kq8yUJHmS
                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............0.............v.... ........@.. .......................@............@................................

                                            File Icon

                                            Icon Hash:00828e8e8686b000

                                            Static PE Info

                                            General

                                            Entrypoint:0x46fa76
                                            Entrypoint Section:.text
                                            Digitally signed:false
                                            Imagebase:0x400000
                                            Subsystem:windows gui
                                            Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                            DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                            Time Stamp:0x60C39E04 [Fri Jun 11 17:31:48 2021 UTC]
                                            TLS Callbacks:
                                            CLR (.Net) Version:v4.0.30319
                                            OS Version Major:4
                                            OS Version Minor:0
                                            File Version Major:4
                                            File Version Minor:0
                                            Subsystem Version Major:4
                                            Subsystem Version Minor:0
                                            Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                            Entrypoint Preview

                                            Instruction
                                            jmp dword ptr [00402000h]
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al

                                            Data Directories

                                            NameVirtual AddressVirtual Size Is in Section
                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x6fa240x4f.text
                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x700000x5a4.rsrc
                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x720000xc.reloc
                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                            Sections

                                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                            .text0x20000x6da7c0x6dc00False0.889724071042data7.77523245185IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                            .rsrc0x700000x5a40x600False0.419921875data4.071391437IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                            .reloc0x720000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                            Resources

                                            NameRVASizeTypeLanguageCountry
                                            RT_VERSION0x700900x314data
                                            RT_MANIFEST0x703b40x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                            Imports

                                            DLLImport
                                            mscoree.dll_CorExeMain

                                            Version Infos

                                            DescriptionData
                                            Translation0x0000 0x04b0
                                            LegalCopyrightCopyright 2018
                                            Assembly Version1.0.0.0
                                            InternalNamevJdJ.exe
                                            FileVersion1.0.0.0
                                            CompanyName
                                            LegalTrademarks
                                            Comments
                                            ProductNameTopdownDll
                                            ProductVersion1.0.0.0
                                            FileDescriptionTopdownDll
                                            OriginalFilenamevJdJ.exe

                                            Network Behavior

                                            No network behavior found

                                            Code Manipulations

                                            Statistics

                                            Behavior

                                            Click to jump to process

                                            System Behavior

                                            Analysis Process: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 6452 Parent PID: 5900

                                            General

                                            Start time:21:11:59
                                            Start date:11/06/2021
                                            Path:C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe
                                            Wow64 process (32bit):true
                                            Commandline:'C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe'
                                            Imagebase:0x900000
                                            File size:452096 bytes
                                            MD5 hash:1B323FCF40192AFD8C2D85ACCA658E7C
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:.Net C# or VB.NET
                                            Yara matches:
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.287835589.0000000003EBC000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.288101589.000000000404D000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.288101589.000000000404D000.00000004.00000001.sdmp, Author: Joe Security
                                            Reputation:low

                                            Analysis Process: schtasks.exe PID: 4908 Parent PID: 6452

                                            General

                                            Start time:21:12:37
                                            Start date:11/06/2021
                                            Path:C:\Windows\SysWOW64\schtasks.exe
                                            Wow64 process (32bit):true
                                            Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NkYArXVCGCJ' /XML 'C:\Users\user\AppData\Local\Temp\tmp4F70.tmp'
                                            Imagebase:0x300000
                                            File size:185856 bytes
                                            MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high

                                            Analysis Process: conhost.exe PID: 5092 Parent PID: 4908

                                            General

                                            Start time:21:12:38
                                            Start date:11/06/2021
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff6b2800000
                                            File size:625664 bytes
                                            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high

                                            Analysis Process: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 5568 Parent PID: 6452

                                            General

                                            Start time:21:12:38
                                            Start date:11/06/2021
                                            Path:C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe
                                            Wow64 process (32bit):false
                                            Commandline:{path}
                                            Imagebase:0x150000
                                            File size:452096 bytes
                                            MD5 hash:1B323FCF40192AFD8C2D85ACCA658E7C
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:low

                                            Analysis Process: shipping documents for PO#813-25319 192-463-56-265-3327.exe PID: 5736 Parent PID: 6452

                                            General

                                            Start time:21:12:39
                                            Start date:11/06/2021
                                            Path:C:\Users\user\Desktop\shipping documents for PO#813-25319 192-463-56-265-3327.exe
                                            Wow64 process (32bit):true
                                            Commandline:{path}
                                            Imagebase:0x650000
                                            File size:452096 bytes
                                            MD5 hash:1B323FCF40192AFD8C2D85ACCA658E7C
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:.Net C# or VB.NET
                                            Yara matches:
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.469314122.0000000002A41000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000B.00000000.284322277.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000B.00000002.466209715.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                            Reputation:low

                                            Disassembly

                                            Code Analysis

                                            Reset < >