Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Windows Analysis Report Purchase Order-568149.exe

Overview

General Information

Sample Name:Purchase Order-568149.exe
Analysis ID:458886
MD5:83f1afd58bf104cb33facc556d7bae89
SHA1:4d57ea68149da873d3da6de49241d1cd33f1b3f3
SHA256:f0a5918de0509be93ffa64be5e74942989fa8acd94b34b6659f479d22abab0ca
Tags:exe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected AgentTesla
Yara detected AgentTesla
Yara detected AntiVM3
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Moves itself to temp directory
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • Purchase Order-568149.exe (PID: 3452 cmdline: 'C:\Users\user\Desktop\Purchase Order-568149.exe' MD5: 83F1AFD58BF104CB33FACC556D7BAE89)
    • schtasks.exe (PID: 2520 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RQqbzWGR' /XML 'C:\Users\user\AppData\Local\Temp\tmp5CCB.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 5668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • Purchase Order-568149.exe (PID: 2796 cmdline: C:\Users\user\Desktop\Purchase Order-568149.exe MD5: 83F1AFD58BF104CB33FACC556D7BAE89)
      • schtasks.exe (PID: 5012 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TxWUEITvoDwYs' /XML 'C:\Users\user\AppData\Local\Temp\tmp8013.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
        • conhost.exe (PID: 5824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • Purchase Order-568149.exe (PID: 3916 cmdline: C:\Users\user\Desktop\Purchase Order-568149.exe MD5: 83F1AFD58BF104CB33FACC556D7BAE89)
      • Purchase Order-568149.exe (PID: 3728 cmdline: C:\Users\user\Desktop\Purchase Order-568149.exe MD5: 83F1AFD58BF104CB33FACC556D7BAE89)
  • YYtJku.exe (PID: 5800 cmdline: 'C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe' MD5: 83F1AFD58BF104CB33FACC556D7BAE89)
    • schtasks.exe (PID: 5788 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RQqbzWGR' /XML 'C:\Users\user\AppData\Local\Temp\tmp31EE.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 1676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • YYtJku.exe (PID: 4788 cmdline: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe MD5: 83F1AFD58BF104CB33FACC556D7BAE89)
      • schtasks.exe (PID: 4700 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TxWUEITvoDwYs' /XML 'C:\Users\user\AppData\Local\Temp\tmp51AB.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
        • conhost.exe (PID: 5608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • YYtJku.exe (PID: 4752 cmdline: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe MD5: 83F1AFD58BF104CB33FACC556D7BAE89)
  • YYtJku.exe (PID: 5964 cmdline: 'C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe' MD5: 83F1AFD58BF104CB33FACC556D7BAE89)
    • schtasks.exe (PID: 2944 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RQqbzWGR' /XML 'C:\Users\user\AppData\Local\Temp\tmp5526.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 5104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • YYtJku.exe (PID: 3120 cmdline: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe MD5: 83F1AFD58BF104CB33FACC556D7BAE89)
      • schtasks.exe (PID: 4872 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TxWUEITvoDwYs' /XML 'C:\Users\user\AppData\Local\Temp\tmp75EC.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
        • conhost.exe (PID: 1236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • YYtJku.exe (PID: 5864 cmdline: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe MD5: 83F1AFD58BF104CB33FACC556D7BAE89)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000026.00000002.598185480.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000026.00000002.598185480.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000019.00000002.509309042.0000000003188000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
        00000007.00000002.390113039.0000000003B49000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000007.00000002.390113039.0000000003B49000.00000004.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
            Click to see the 26 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            7.2.Purchase Order-568149.exe.4097118.4.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              7.2.Purchase Order-568149.exe.4097118.4.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                7.2.Purchase Order-568149.exe.4097118.4.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  7.2.Purchase Order-568149.exe.4097118.4.raw.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    11.2.Purchase Order-568149.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 1 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Jbx Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Machine Learning detection for dropped fileShow sources
                      Source: C:\Users\user\AppData\Roaming\RQqbzWGR.exeJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Roaming\TxWUEITvoDwYs.exeJoe Sandbox ML: detected
                      Machine Learning detection for sampleShow sources
                      Source: Purchase Order-568149.exeJoe Sandbox ML: detected
                      Source: 11.2.Purchase Order-568149.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: Purchase Order-568149.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: Purchase Order-568149.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                      Source: Purchase Order-568149.exe, 0000000B.00000002.604354638.0000000002D81000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: Purchase Order-568149.exe, 0000000B.00000002.604354638.0000000002D81000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: Purchase Order-568149.exe, 0000000B.00000002.604354638.0000000002D81000.00000004.00000001.sdmpString found in binary or memory: http://flUPyp.com
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.335107574.000000000627B000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: Purchase Order-568149.exe, 00000000.00000002.368950363.0000000003568000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.388057190.0000000002B41000.00000004.00000001.sdmp, YYtJku.exe, 00000014.00000002.485090142.00000000039F8000.00000004.00000001.sdmp, YYtJku.exe, 00000019.00000002.509309042.0000000003188000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: Purchase Order-568149.exe, 00000000.00000003.340362356.0000000006283000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.340187214.0000000006283000.00000004.00000001.sdmpString found in binary or memory: http://www.ascendercorp.com/typedesigners.html
                      Source: Purchase Order-568149.exe, 00000000.00000003.338695199.0000000006280000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
                      Source: Purchase Order-568149.exe, 00000000.00000003.338887957.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com(
                      Source: Purchase Order-568149.exe, 00000000.00000003.339169323.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com-g
                      Source: Purchase Order-568149.exe, 00000000.00000003.338801736.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com-s(9
                      Source: Purchase Order-568149.exe, 00000000.00000003.338801736.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com.
                      Source: Purchase Order-568149.exe, 00000000.00000003.339169323.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comX
                      Source: Purchase Order-568149.exe, 00000000.00000003.339250764.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comal
                      Source: Purchase Order-568149.exe, 00000000.00000003.339207360.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comd
                      Source: Purchase Order-568149.exe, 00000000.00000003.339169323.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comg
                      Source: Purchase Order-568149.exe, 00000000.00000003.339250764.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comint
                      Source: Purchase Order-568149.exe, 00000000.00000003.339041249.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comkf
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: Purchase Order-568149.exe, 00000000.00000003.338801736.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comn-u
                      Source: Purchase Order-568149.exe, 00000000.00000003.338695199.0000000006280000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comncyI)
                      Source: Purchase Order-568149.exe, 00000000.00000003.339250764.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.como.
                      Source: Purchase Order-568149.exe, 00000000.00000003.339041249.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comopsz
                      Source: Purchase Order-568149.exe, 00000000.00000003.338801736.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comuct
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: Purchase Order-568149.exe, 00000000.00000003.343752332.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers%
                      Source: Purchase Order-568149.exe, 00000000.00000003.343351772.0000000006283000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/
                      Source: Purchase Order-568149.exe, 00000000.00000003.343351772.0000000006283000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/(
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: Purchase Order-568149.exe, 00000000.00000003.344360147.000000000629E000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: Purchase Order-568149.exe, 00000000.00000003.343958618.000000000629E000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.344056196.000000000627B000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                      Source: Purchase Order-568149.exe, 00000000.00000003.344384695.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers1
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: Purchase Order-568149.exe, 00000000.00000003.343710141.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersB
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: Purchase Order-568149.exe, 00000000.00000003.343351772.0000000006283000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersp
                      Source: Purchase Order-568149.exe, 00000000.00000003.344536866.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designerss
                      Source: Purchase Order-568149.exe, 00000000.00000003.343972634.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designerst
                      Source: Purchase Order-568149.exe, 00000000.00000002.367870273.0000000001897000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comF
                      Source: Purchase Order-568149.exe, 00000000.00000002.367870273.0000000001897000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comceta
                      Source: Purchase Order-568149.exe, 00000000.00000002.367870273.0000000001897000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comm
                      Source: Purchase Order-568149.exe, 00000000.00000002.367870273.0000000001897000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comueto
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: Purchase Order-568149.exe, 00000000.00000003.337312703.0000000006282000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
                      Source: Purchase Order-568149.exe, 00000000.00000003.338172221.0000000006280000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/a
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: Purchase Order-568149.exe, 00000000.00000003.337201985.0000000006282000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/ef1H
                      Source: Purchase Order-568149.exe, 00000000.00000003.338172221.0000000006280000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cna
                      Source: Purchase Order-568149.exe, 00000000.00000003.338022670.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cna-d
                      Source: Purchase Order-568149.exe, 00000000.00000003.338340603.0000000006280000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnadeB8
                      Source: Purchase Order-568149.exe, 00000000.00000003.338695199.0000000006280000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnarkp9
                      Source: Purchase Order-568149.exe, 00000000.00000003.338340603.0000000006280000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnl-g
                      Source: Purchase Order-568149.exe, 00000000.00000003.338695199.0000000006280000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnl9
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.347259856.000000000627B000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.346410625.000000000627B000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.337071254.000000000627B000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: Purchase Order-568149.exe, 00000000.00000003.343581227.000000000627B000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.342502988.0000000006283000.00000004.00000001.sdmpString found in binary or memory: http://www.monotype.
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.333996874.0000000006262000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: Purchase Order-568149.exe, 00000000.00000003.333996874.0000000006262000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comau
                      Source: Purchase Order-568149.exe, 00000000.00000003.333996874.0000000006262000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comt
                      Source: Purchase Order-568149.exe, 00000000.00000003.340362356.0000000006283000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: Purchase Order-568149.exe, 00000000.00000003.340229745.0000000006283000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com(
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: Purchase Order-568149.exe, 00000000.00000003.337071254.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krn-un(
                      Source: Purchase Order-568149.exe, 00000000.00000003.337071254.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krn-usur-(
                      Source: YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: Purchase Order-568149.exe, 00000000.00000003.339250764.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com:
                      Source: Purchase Order-568149.exe, 00000000.00000003.338400000.0000000006280000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comb3
                      Source: Purchase Order-568149.exe, 00000000.00000003.338400000.0000000006280000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.coms89k3
                      Source: Purchase Order-568149.exe, 00000000.00000003.339250764.000000000627B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comslnt
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: Purchase Order-568149.exe, 00000000.00000003.344663261.0000000006288000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.de
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: Purchase Order-568149.exe, 00000000.00000003.343184556.0000000006283000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deld
                      Source: Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: Purchase Order-568149.exe, 00000000.00000003.338649193.0000000006280000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cnC
                      Source: Purchase Order-568149.exe, 00000007.00000002.390113039.0000000003B49000.00000004.00000001.sdmp, Purchase Order-568149.exe, 0000000B.00000002.596505185.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: Purchase Order-568149.exe, 0000000B.00000002.604354638.0000000002D81000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: Purchase Order-568149.exe, 00000000.00000002.367573207.00000000015A8000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

                      System Summary:

                      barindex
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: Purchase Order-568149.exe
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 0_2_00CAB673
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 0_2_0184C27C
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 0_2_0184EC48
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 0_2_0184EC58
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 0_2_00CAB6C0
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_0065B673
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_02B0C2B0
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_02B09990
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_06D93288
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_06D95C48
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_06D94B07
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_06D925D8
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_06D925CA
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_06D92270
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_06D9323C
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_06D93087
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_06D92C9A
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_0065B6C0
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 10_2_003AB673
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 10_2_003AB6C0
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 11_2_0079B673
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 11_2_00E426C0
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 11_2_00E42088
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 11_2_00E47980
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 11_2_05EA7540
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 11_2_05EA94F8
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 11_2_05EA6928
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 11_2_05EA6C70
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 11_2_0079B6C0
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_00F7B673
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_03562640
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_03560EC0
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_03561152
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_03563598
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_03560088
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_035627EB
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_03562630
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_03560AD8
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_03560AE8
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_03560EAF
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_03561103
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_03560078
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_035610F7
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_035CC27C
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_035CEC58
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_035CEC48
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeCode function: 20_2_00F7B6C0
                      Source: Purchase Order-568149.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: RQqbzWGR.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: TxWUEITvoDwYs.exe.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: Purchase Order-568149.exe, 00000000.00000002.366937225.0000000000E42000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameDefaultBind.exe2 vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 00000000.00000002.371167093.0000000004219000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameStoreElement.dllB vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 00000000.00000002.368027608.0000000003211000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameConfigNodeType.dll> vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 00000000.00000002.382480419.000000000EBF0000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 00000000.00000002.368950363.0000000003568000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameIterat.exe6 vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 00000000.00000002.381807418.0000000007D30000.00000002.00000001.sdmpBinary or memory string: originalfilename vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 00000000.00000002.381807418.0000000007D30000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 00000007.00000002.395732429.0000000006FC0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameStoreElement.dllB vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 00000007.00000002.390113039.0000000003B49000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameOAjkwywGgDZRPlpDvXYAZcNpbuMAeyPX.exe4 vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 00000007.00000002.398144304.000000000E370000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 00000007.00000002.386573397.00000000007F2000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameDefaultBind.exe2 vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 00000007.00000002.388057190.0000000002B41000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameConfigNodeType.dll> vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 00000007.00000002.395571592.0000000006D00000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 00000007.00000002.386040104.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameIterat.exe6 vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 00000007.00000002.398516578.000000000E460000.00000002.00000001.sdmpBinary or memory string: originalfilename vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 00000007.00000002.398516578.000000000E460000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 0000000A.00000002.383597284.0000000000542000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameDefaultBind.exe2 vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 0000000B.00000003.435818261.00000000064F1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDefaultBind.exe2 vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 0000000B.00000002.602229842.00000000010CA000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exe, 0000000B.00000002.596505185.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameOAjkwywGgDZRPlpDvXYAZcNpbuMAeyPX.exe4 vs Purchase Order-568149.exe
                      Source: Purchase Order-568149.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: Purchase Order-568149.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: RQqbzWGR.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: TxWUEITvoDwYs.exe.7.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: classification engineClassification label: mal100.troj.evad.winEXE@31/11@0/0
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeFile created: C:\Users\user\AppData\Roaming\RQqbzWGR.exeJump to behavior
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5668:120:WilError_01
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1676:120:WilError_01
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeMutant created: \Sessions\1\BaseNamedObjects\XHreRguTKPVHTcWBiISLJQIUy
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5824:120:WilError_01
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeMutant created: \Sessions\1\BaseNamedObjects\OCgTDpZUOzlrmFcbIEUognwVzHx
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeFile created: C:\Users\user\AppData\Local\Temp\tmp5CCB.tmpJump to behavior
                      Source: Purchase Order-568149.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeFile read: C:\Users\user\Desktop\Purchase Order-568149.exeJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\Purchase Order-568149.exe 'C:\Users\user\Desktop\Purchase Order-568149.exe'
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RQqbzWGR' /XML 'C:\Users\user\AppData\Local\Temp\tmp5CCB.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Users\user\Desktop\Purchase Order-568149.exe C:\Users\user\Desktop\Purchase Order-568149.exe
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TxWUEITvoDwYs' /XML 'C:\Users\user\AppData\Local\Temp\tmp8013.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Users\user\Desktop\Purchase Order-568149.exe C:\Users\user\Desktop\Purchase Order-568149.exe
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Users\user\Desktop\Purchase Order-568149.exe C:\Users\user\Desktop\Purchase Order-568149.exe
                      Source: unknownProcess created: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe 'C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe'
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RQqbzWGR' /XML 'C:\Users\user\AppData\Local\Temp\tmp31EE.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: unknownProcess created: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe 'C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe'
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TxWUEITvoDwYs' /XML 'C:\Users\user\AppData\Local\Temp\tmp51AB.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RQqbzWGR' /XML 'C:\Users\user\AppData\Local\Temp\tmp5526.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TxWUEITvoDwYs' /XML 'C:\Users\user\AppData\Local\Temp\tmp75EC.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RQqbzWGR' /XML 'C:\Users\user\AppData\Local\Temp\tmp5CCB.tmp'
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Users\user\Desktop\Purchase Order-568149.exe C:\Users\user\Desktop\Purchase Order-568149.exe
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TxWUEITvoDwYs' /XML 'C:\Users\user\AppData\Local\Temp\tmp8013.tmp'
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Users\user\Desktop\Purchase Order-568149.exe C:\Users\user\Desktop\Purchase Order-568149.exe
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Users\user\Desktop\Purchase Order-568149.exe C:\Users\user\Desktop\Purchase Order-568149.exe
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RQqbzWGR' /XML 'C:\Users\user\AppData\Local\Temp\tmp31EE.tmp'
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RQqbzWGR' /XML 'C:\Users\user\AppData\Local\Temp\tmp5526.tmp'
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                      Source: Purchase Order-568149.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: Purchase Order-568149.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                      Source: Purchase Order-568149.exeStatic file information: File size 1958400 > 1048576
                      Source: Purchase Order-568149.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x19ec00
                      Source: Purchase Order-568149.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 0_2_00CAC9C6 push es; ret
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 0_2_00CAB673 push es; iretd
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 0_2_00CAB673 push es; retf
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 0_2_00CAB673 push es; retf 0001h
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 0_2_00CAC976 push es; retf 0001h
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 0_2_00CAC976 push es; ret
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 0_2_00CAC976 push es; retn 0001h
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 0_2_00CAC836 push es; retf
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 0_2_0184C25C push ebx; iretd
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 0_2_00CAB6C0 push es; iretd
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_0065C976 push es; retf 0001h
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_0065C976 push es; ret
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_0065C976 push es; retn 0001h
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_0065B673 push es; iretd
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_0065B673 push es; retf
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_0065B673 push es; retf 0001h
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_0065C9C6 push es; ret
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_0065C836 push es; retf
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_06D94529 push es; ret
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 7_2_0065B6C0 push es; iretd
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 10_2_003AC836 push es; retf
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 10_2_003AB673 push es; iretd
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 10_2_003AB673 push es; retf
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 10_2_003AB673 push es; retf 0001h
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 10_2_003AC976 push es; retf 0001h
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 10_2_003AC976 push es; ret
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 10_2_003AC976 push es; retn 0001h
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 10_2_003AC9C6 push es; ret
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 10_2_003AB6C0 push es; iretd
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 11_2_0079B673 push es; iretd
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 11_2_0079B673 push es; retf
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.43251327113
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.43251327113
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.43251327113
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeFile created: C:\Users\user\AppData\Roaming\RQqbzWGR.exeJump to dropped file
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeFile created: C:\Users\user\AppData\Roaming\TxWUEITvoDwYs.exeJump to dropped file
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeFile created: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeJump to dropped file

                      Boot Survival:

                      barindex
                      Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RQqbzWGR' /XML 'C:\Users\user\AppData\Local\Temp\tmp5CCB.tmp'
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run YYtJkuJump to behavior
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run YYtJkuJump to behavior

                      Hooking and other Techniques for Hiding and Protection:

                      barindex
                      Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeFile opened: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe:Zone.Identifier read attributes | delete
                      Moves itself to temp directoryShow sources
                      Source: c:\users\user\desktop\purchase order-568149.exeFile moved: C:\Users\user\AppData\Local\Temp\tmpG593.tmpJump to behavior
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: 00000019.00000002.509309042.0000000003188000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.368950363.0000000003568000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000014.00000002.485090142.00000000039F8000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000002.389374922.0000000002CCB000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000002.507876380.000000000313B000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000022.00000002.530832386.0000000002E8B000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Purchase Order-568149.exe PID: 3452, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: Purchase Order-568149.exe PID: 2796, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: YYtJku.exe PID: 5800, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: YYtJku.exe PID: 5964, type: MEMORYSTR
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: Purchase Order-568149.exe, 00000000.00000002.368950363.0000000003568000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.389374922.0000000002CCB000.00000004.00000001.sdmp, YYtJku.exe, 00000014.00000002.485090142.00000000039F8000.00000004.00000001.sdmp, YYtJku.exe, 00000019.00000002.509309042.0000000003188000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                      Source: Purchase Order-568149.exe, 00000000.00000002.368950363.0000000003568000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.389374922.0000000002CCB000.00000004.00000001.sdmp, YYtJku.exe, 00000014.00000002.485090142.00000000039F8000.00000004.00000001.sdmp, YYtJku.exe, 00000019.00000002.509309042.0000000003188000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeWindow / User API: threadDelayed 2315
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeWindow / User API: threadDelayed 7509
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exe TID: 5116Thread sleep time: -45597s >= -30000s
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exe TID: 1676Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exe TID: 2944Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exe TID: 2996Thread sleep time: -44519s >= -30000s
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exe TID: 6112Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exe TID: 1428Thread sleep time: -19369081277395017s >= -30000s
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exe TID: 6092Thread sleep count: 2315 > 30
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exe TID: 6092Thread sleep count: 7509 > 30
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe TID: 1180Thread sleep time: -46615s >= -30000s
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe TID: 1208Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe TID: 160Thread sleep time: -45036s >= -30000s
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe TID: 5084Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeThread delayed: delay time: 45597
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeThread delayed: delay time: 44519
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeThread delayed: delay time: 46615
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeThread delayed: delay time: 45036
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeThread delayed: delay time: 922337203685477
                      Source: YYtJku.exe, 00000019.00000002.509309042.0000000003188000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: YYtJku.exe, 00000019.00000002.509309042.0000000003188000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: YYtJku.exe, 00000019.00000002.509309042.0000000003188000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                      Source: YYtJku.exe, 00000019.00000002.509309042.0000000003188000.00000004.00000001.sdmpBinary or memory string: VMWARE
                      Source: YYtJku.exe, 00000019.00000002.509309042.0000000003188000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: YYtJku.exe, 00000019.00000002.509309042.0000000003188000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                      Source: YYtJku.exe, 00000019.00000002.509309042.0000000003188000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                      Source: YYtJku.exe, 00000019.00000002.509309042.0000000003188000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess information queried: ProcessInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess token adjusted: Debug
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess token adjusted: Debug
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeMemory allocated: page read and write | page guard

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeMemory written: C:\Users\user\Desktop\Purchase Order-568149.exe base: 400000 value starts with: 4D5A
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeMemory written: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe base: 400000 value starts with: 4D5A
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RQqbzWGR' /XML 'C:\Users\user\AppData\Local\Temp\tmp5CCB.tmp'
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Users\user\Desktop\Purchase Order-568149.exe C:\Users\user\Desktop\Purchase Order-568149.exe
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TxWUEITvoDwYs' /XML 'C:\Users\user\AppData\Local\Temp\tmp8013.tmp'
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Users\user\Desktop\Purchase Order-568149.exe C:\Users\user\Desktop\Purchase Order-568149.exe
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeProcess created: C:\Users\user\Desktop\Purchase Order-568149.exe C:\Users\user\Desktop\Purchase Order-568149.exe
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RQqbzWGR' /XML 'C:\Users\user\AppData\Local\Temp\tmp31EE.tmp'
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RQqbzWGR' /XML 'C:\Users\user\AppData\Local\Temp\tmp5526.tmp'
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeProcess created: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                      Source: Purchase Order-568149.exe, 0000000B.00000002.603762841.00000000017E0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: Purchase Order-568149.exe, 0000000B.00000002.603762841.00000000017E0000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: Purchase Order-568149.exe, 0000000B.00000002.603762841.00000000017E0000.00000002.00000001.sdmpBinary or memory string: &Program Manager
                      Source: Purchase Order-568149.exe, 0000000B.00000002.603762841.00000000017E0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Users\user\Desktop\Purchase Order-568149.exe VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Users\user\Desktop\Purchase Order-568149.exe VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Users\user\Desktop\Purchase Order-568149.exe VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeQueries volume information: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeQueries volume information: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeCode function: 11_2_05EA5A94 GetUserNameW,
                      Source: C:\Users\user\Desktop\Purchase Order-568149.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 7.2.Purchase Order-568149.exe.4097118.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 7.2.Purchase Order-568149.exe.4097118.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.Purchase Order-568149.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000026.00000002.598185480.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000002.390113039.0000000003B49000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000002.508939445.0000000003FB9000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.596505185.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000021.00000002.531888040.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000022.00000002.532092035.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 7.2.Purchase Order-568149.exe.4097118.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 7.2.Purchase Order-568149.exe.4097118.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.Purchase Order-568149.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000026.00000002.598185480.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000002.390113039.0000000003B49000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000021.00000002.534207438.0000000002E71000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000002.508939445.0000000003FB9000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.596505185.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000026.00000002.603696462.0000000003291000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000021.00000002.531888040.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.604354638.0000000002D81000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000022.00000002.532092035.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Purchase Order-568149.exe PID: 2796, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: Purchase Order-568149.exe PID: 3728, type: MEMORYSTR
                      Source: Yara matchFile source: 00000021.00000002.534207438.0000000002E71000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000026.00000002.603696462.0000000003291000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.604354638.0000000002D81000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Purchase Order-568149.exe PID: 3728, type: MEMORYSTR

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 7.2.Purchase Order-568149.exe.4097118.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 7.2.Purchase Order-568149.exe.4097118.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.Purchase Order-568149.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000026.00000002.598185480.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000002.390113039.0000000003B49000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000002.508939445.0000000003FB9000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.596505185.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000021.00000002.531888040.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000022.00000002.532092035.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 7.2.Purchase Order-568149.exe.4097118.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 7.2.Purchase Order-568149.exe.4097118.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 11.2.Purchase Order-568149.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000026.00000002.598185480.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000002.390113039.0000000003B49000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000021.00000002.534207438.0000000002E71000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000002.508939445.0000000003FB9000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.596505185.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000026.00000002.603696462.0000000003291000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000021.00000002.531888040.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000B.00000002.604354638.0000000002D81000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000022.00000002.532092035.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Purchase Order-568149.exe PID: 2796, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: Purchase Order-568149.exe PID: 3728, type: MEMORYSTR

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211Scheduled Task/Job1Process Injection112Masquerading11Input Capture1Query Registry1Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/Job1Registry Run Keys / Startup Folder1Scheduled Task/Job1Disable or Modify Tools1LSASS MemorySecurity Software Discovery211Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Registry Run Keys / Startup Folder1Virtualization/Sandbox Evasion131Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection112NTDSVirtualization/Sandbox Evasion131Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptHidden Files and Directories1LSA SecretsApplication Window Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information3Cached Domain CredentialsAccount Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing3DCSyncSystem Owner/User Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemFile and Directory Discovery1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadowSystem Information Discovery113Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 signatures2 2 Behavior Graph ID: 458886 Sample: Purchase Order-568149.exe Startdate: 03/08/2021 Architecture: WINDOWS Score: 100 53 Yara detected AgentTesla 2->53 55 Yara detected AgentTesla 2->55 57 Yara detected AntiVM3 2->57 59 7 other signatures 2->59 8 Purchase Order-568149.exe 7 2->8         started        12 YYtJku.exe 5 2->12         started        14 YYtJku.exe 2->14         started        process3 file4 45 C:\Users\user\AppData\Roaming\RQqbzWGR.exe, PE32 8->45 dropped 47 C:\Users\...\RQqbzWGR.exe:Zone.Identifier, ASCII 8->47 dropped 49 C:\Users\user\AppData\Local\...\tmp5CCB.tmp, XML 8->49 dropped 51 C:\Users\...\Purchase Order-568149.exe.log, ASCII 8->51 dropped 65 Injects a PE file into a foreign processes 8->65 16 Purchase Order-568149.exe 6 8->16         started        19 schtasks.exe 1 8->19         started        67 Machine Learning detection for dropped file 12->67 21 schtasks.exe 12->21         started        signatures5 process6 file7 37 C:\Users\user\AppData\...\TxWUEITvoDwYs.exe, PE32 16->37 dropped 39 C:\...\TxWUEITvoDwYs.exe:Zone.Identifier, ASCII 16->39 dropped 23 Purchase Order-568149.exe 2 5 16->23         started        27 schtasks.exe 1 16->27         started        29 Purchase Order-568149.exe 16->29         started        31 conhost.exe 19->31         started        33 conhost.exe 21->33         started        process8 file9 41 C:\Users\user\AppData\Roaming\...\YYtJku.exe, PE32 23->41 dropped 43 C:\Users\user\...\YYtJku.exe:Zone.Identifier, ASCII 23->43 dropped 61 Moves itself to temp directory 23->61 63 Hides that the sample has been downloaded from the Internet (zone.identifier) 23->63 35 conhost.exe 27->35         started        signatures10 process11

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      Purchase Order-568149.exe100%Joe Sandbox ML

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\Users\user\AppData\Roaming\RQqbzWGR.exe100%Joe Sandbox ML
                      C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe100%Joe Sandbox ML
                      C:\Users\user\AppData\Roaming\TxWUEITvoDwYs.exe100%Joe Sandbox ML

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      11.2.Purchase Order-568149.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File

                      Domains

                      No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://www.tiro.com:0%VirustotalBrowse
                      http://www.tiro.com:0%Avira URL Cloudsafe
                      http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                      http://www.founder.com.cn/cnarkp90%Avira URL Cloudsafe
                      http://www.carterandcone.comn-u0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.zhongyicts.com.cnC0%Avira URL Cloudsafe
                      http://www.urwpp.deld0%Avira URL Cloudsafe
                      http://www.tiro.coms89k30%Avira URL Cloudsafe
                      http://www.carterandcone.com-s(90%Avira URL Cloudsafe
                      http://www.carterandcone.comal0%URL Reputationsafe
                      http://www.founder.com.cn/cna-d0%URL Reputationsafe
                      http://www.sandoll.co.krn-un(0%Avira URL Cloudsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.fontbureau.comceta0%Avira URL Cloudsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.carterandcone.com0%URL Reputationsafe
                      http://www.carterandcone.com(0%Avira URL Cloudsafe
                      http://www.carterandcone.com.0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://www.founder.com.cn/cnl-g0%Avira URL Cloudsafe
                      http://www.founder.com.cn/cn/ef1H0%Avira URL Cloudsafe
                      http://www.founder.com.cn/cn/a0%Avira URL Cloudsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://flUPyp.com0%Avira URL Cloudsafe
                      http://www.founder.com.cn/cna0%URL Reputationsafe
                      http://www.ascendercorp.com/typedesigners.html0%URL Reputationsafe
                      http://www.carterandcone.comuct0%Avira URL Cloudsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.de0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.carterandcone.como.0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      http://www.carterandcone.comncyI)0%Avira URL Cloudsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://www.fontbureau.comF0%URL Reputationsafe
                      http://www.carterandcone.comd0%URL Reputationsafe
                      http://www.sajatypeworks.comt0%URL Reputationsafe
                      http://www.tiro.comslnt0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      http://www.carterandcone.comX0%URL Reputationsafe
                      http://www.tiro.comb30%Avira URL Cloudsafe
                      http://www.fontbureau.comueto0%Avira URL Cloudsafe
                      http://www.carterandcone.comg0%Avira URL Cloudsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.founder.com.cn/cn/0%URL Reputationsafe
                      http://www.founder.com.cn/cnl90%Avira URL Cloudsafe
                      http://www.carterandcone.comint0%Avira URL Cloudsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.monotype.0%URL Reputationsafe
                      http://www.sakkal.com(0%Avira URL Cloudsafe
                      http://www.fontbureau.comm0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.sandoll.co.krn-usur-(0%Avira URL Cloudsafe
                      http://www.sajatypeworks.comau0%Avira URL Cloudsafe
                      http://www.founder.com.cn/cnadeB80%Avira URL Cloudsafe
                      http://www.carterandcone.comkf0%Avira URL Cloudsafe
                      http://www.carterandcone.com-g0%Avira URL Cloudsafe
                      http://www.carterandcone.comopsz0%Avira URL Cloudsafe

                      Domains and IPs

                      Contacted Domains

                      No contacted domains info

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://www.tiro.com:Purchase Order-568149.exe, 00000000.00000003.339250764.000000000627B000.00000004.00000001.sdmpfalse
                      • 0%, Virustotal, Browse
                      • Avira URL Cloud: safe
                      		unknown
                      http://127.0.0.1:HTTP/1.1Purchase Order-568149.exe, 0000000B.00000002.604354638.0000000002D81000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		low
                      http://www.fontbureau.com/designersGPurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                        		high
                        http://www.founder.com.cn/cnarkp9Purchase Order-568149.exe, 00000000.00000003.338695199.0000000006280000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.carterandcone.comn-uPurchase Order-568149.exe, 00000000.00000003.338801736.000000000627B000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designers/?Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                          		high
                          http://www.founder.com.cn/cn/bThePurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.zhongyicts.com.cnCPurchase Order-568149.exe, 00000000.00000003.338649193.0000000006280000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.urwpp.deldPurchase Order-568149.exe, 00000000.00000003.343184556.0000000006283000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.fontbureau.com/designers?Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                            		high
                            http://www.tiro.coms89k3Purchase Order-568149.exe, 00000000.00000003.338400000.0000000006280000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.carterandcone.com-s(9Purchase Order-568149.exe, 00000000.00000003.338801736.000000000627B000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		low
                            http://www.carterandcone.comalPurchase Order-568149.exe, 00000000.00000003.339250764.000000000627B000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.com/designersBPurchase Order-568149.exe, 00000000.00000003.343710141.000000000627B000.00000004.00000001.sdmpfalse
                              		high
                              http://www.founder.com.cn/cna-dPurchase Order-568149.exe, 00000000.00000003.338022670.000000000627B000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.sandoll.co.krn-un(Purchase Order-568149.exe, 00000000.00000003.337071254.000000000627B000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		low
                              http://www.tiro.comYYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.comcetaPurchase Order-568149.exe, 00000000.00000002.367870273.0000000001897000.00000004.00000040.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.fontbureau.com/designersYYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                		high
                                http://www.goodfont.co.krPurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.337071254.000000000627B000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.carterandcone.comPurchase Order-568149.exe, 00000000.00000003.338695199.0000000006280000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.carterandcone.com(Purchase Order-568149.exe, 00000000.00000003.338887957.000000000627B000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		low
                                http://www.carterandcone.com.Purchase Order-568149.exe, 00000000.00000003.338801736.000000000627B000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.sajatypeworks.comPurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.333996874.0000000006262000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.typography.netDPurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.founder.com.cn/cn/cThePurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.galapagosdesign.com/staff/dennis.htmPurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.347259856.000000000627B000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.346410625.000000000627B000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://fontfabrik.comPurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.335107574.000000000627B000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.founder.com.cn/cnl-gPurchase Order-568149.exe, 00000000.00000003.338340603.0000000006280000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.founder.com.cn/cn/ef1HPurchase Order-568149.exe, 00000000.00000003.337201985.0000000006282000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.founder.com.cn/cn/aPurchase Order-568149.exe, 00000000.00000003.338172221.0000000006280000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.galapagosdesign.com/DPleasePurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://flUPyp.comPurchase Order-568149.exe, 0000000B.00000002.604354638.0000000002D81000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.founder.com.cn/cnaPurchase Order-568149.exe, 00000000.00000003.338172221.0000000006280000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.ascendercorp.com/typedesigners.htmlPurchase Order-568149.exe, 00000000.00000003.340362356.0000000006283000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.340187214.0000000006283000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.carterandcone.comuctPurchase Order-568149.exe, 00000000.00000003.338801736.000000000627B000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.fonts.comPurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                  		high
                                  http://www.sandoll.co.krPurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.urwpp.deDPleasePurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.urwpp.dePurchase Order-568149.exe, 00000000.00000003.344663261.0000000006288000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.zhongyicts.com.cnPurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namePurchase Order-568149.exe, 00000000.00000002.368950363.0000000003568000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.388057190.0000000002B41000.00000004.00000001.sdmp, YYtJku.exe, 00000014.00000002.485090142.00000000039F8000.00000004.00000001.sdmp, YYtJku.exe, 00000019.00000002.509309042.0000000003188000.00000004.00000001.sdmpfalse
                                    		high
                                    http://www.carterandcone.como.Purchase Order-568149.exe, 00000000.00000003.339250764.000000000627B000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.com/designerspPurchase Order-568149.exe, 00000000.00000003.343351772.0000000006283000.00000004.00000001.sdmpfalse
                                      		high
                                      http://www.sakkal.comPurchase Order-568149.exe, 00000000.00000003.340362356.0000000006283000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipPurchase Order-568149.exe, 00000007.00000002.390113039.0000000003B49000.00000004.00000001.sdmp, Purchase Order-568149.exe, 0000000B.00000002.596505185.0000000000402000.00000040.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.carterandcone.comncyI)Purchase Order-568149.exe, 00000000.00000003.338695199.0000000006280000.00000004.00000001.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		low
                                      http://www.fontbureau.com/designers/(Purchase Order-568149.exe, 00000000.00000003.343351772.0000000006283000.00000004.00000001.sdmpfalse
                                        		high
                                        http://www.fontbureau.com/designerstPurchase Order-568149.exe, 00000000.00000003.343972634.000000000627B000.00000004.00000001.sdmpfalse
                                          		high
                                          http://www.fontbureau.com/designerssPurchase Order-568149.exe, 00000000.00000003.344536866.000000000627B000.00000004.00000001.sdmpfalse
                                            		high
                                            http://www.apache.org/licenses/LICENSE-2.0Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                              		high
                                              http://www.fontbureau.comPurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                                		high
                                                http://DynDns.comDynDNSPurchase Order-568149.exe, 0000000B.00000002.604354638.0000000002D81000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.fontbureau.comFPurchase Order-568149.exe, 00000000.00000002.367870273.0000000001897000.00000004.00000040.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.carterandcone.comdPurchase Order-568149.exe, 00000000.00000003.339207360.000000000627B000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.sajatypeworks.comtPurchase Order-568149.exe, 00000000.00000003.333996874.0000000006262000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.tiro.comslntPurchase Order-568149.exe, 00000000.00000003.339250764.000000000627B000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haPurchase Order-568149.exe, 0000000B.00000002.604354638.0000000002D81000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.carterandcone.comXPurchase Order-568149.exe, 00000000.00000003.339169323.000000000627B000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.tiro.comb3Purchase Order-568149.exe, 00000000.00000003.338400000.0000000006280000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.fontbureau.comuetoPurchase Order-568149.exe, 00000000.00000002.367870273.0000000001897000.00000004.00000040.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.carterandcone.comgPurchase Order-568149.exe, 00000000.00000003.339169323.000000000627B000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.carterandcone.comlPurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.founder.com.cn/cn/Purchase Order-568149.exe, 00000000.00000003.337312703.0000000006282000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.fontbureau.com/designers/cabarga.htmlNPurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                                  		high
                                                  http://www.founder.com.cn/cnl9Purchase Order-568149.exe, 00000000.00000003.338695199.0000000006280000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.carterandcone.comintPurchase Order-568149.exe, 00000000.00000003.339250764.000000000627B000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.founder.com.cn/cnPurchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.fontbureau.com/designers/frere-jones.htmlPurchase Order-568149.exe, 00000000.00000003.343958618.000000000629E000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.344056196.000000000627B000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                                    		high
                                                    http://www.fontbureau.com/designers/cabarga.htmlPurchase Order-568149.exe, 00000000.00000003.344360147.000000000629E000.00000004.00000001.sdmpfalse
                                                      		high
                                                      http://www.monotype.Purchase Order-568149.exe, 00000000.00000003.343581227.000000000627B000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000000.00000003.342502988.0000000006283000.00000004.00000001.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://www.sakkal.com(Purchase Order-568149.exe, 00000000.00000003.340229745.0000000006283000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		low
                                                      http://www.fontbureau.com/designers%Purchase Order-568149.exe, 00000000.00000003.343752332.000000000627B000.00000004.00000001.sdmpfalse
                                                        		high
                                                        http://www.fontbureau.commPurchase Order-568149.exe, 00000000.00000002.367870273.0000000001897000.00000004.00000040.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.jiyu-kobo.co.jp/Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.fontbureau.com/designers8Purchase Order-568149.exe, 00000000.00000002.381165884.0000000007472000.00000004.00000001.sdmp, Purchase Order-568149.exe, 00000007.00000002.394788186.0000000005C00000.00000002.00000001.sdmp, YYtJku.exe, 00000014.00000002.497867827.00000000066E0000.00000002.00000001.sdmpfalse
                                                          		high
                                                          http://www.sandoll.co.krn-usur-(Purchase Order-568149.exe, 00000000.00000003.337071254.000000000627B000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		low
                                                          http://www.fontbureau.com/designers1Purchase Order-568149.exe, 00000000.00000003.344384695.000000000627B000.00000004.00000001.sdmpfalse
                                                            		high
                                                            http://www.sajatypeworks.comauPurchase Order-568149.exe, 00000000.00000003.333996874.0000000006262000.00000004.00000001.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            http://www.fontbureau.com/designers/Purchase Order-568149.exe, 00000000.00000003.343351772.0000000006283000.00000004.00000001.sdmpfalse
                                                              		high
                                                              http://www.founder.com.cn/cnadeB8Purchase Order-568149.exe, 00000000.00000003.338340603.0000000006280000.00000004.00000001.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              http://www.carterandcone.comkfPurchase Order-568149.exe, 00000000.00000003.339041249.000000000627B000.00000004.00000001.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              http://www.carterandcone.com-gPurchase Order-568149.exe, 00000000.00000003.339169323.000000000627B000.00000004.00000001.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              http://www.carterandcone.comopszPurchase Order-568149.exe, 00000000.00000003.339041249.000000000627B000.00000004.00000001.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown

                                                              Contacted IPs

                                                              No contacted IP infos

                                                              General Information

                                                              Joe Sandbox Version:33.0.0 White Diamond
                                                              Analysis ID:458886
                                                              Start date:03.08.2021
                                                              Start time:20:40:28
                                                              Joe Sandbox Product:CloudBasic
                                                              Overall analysis duration:0h 13m 59s
                                                              Hypervisor based Inspection enabled:false
                                                              Report type:light
                                                              Sample file name:Purchase Order-568149.exe
                                                              Cookbook file name:default.jbs
                                                              Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                              Number of analysed new started processes analysed:42
                                                              Number of new started drivers analysed:0
                                                              Number of existing processes analysed:0
                                                              Number of existing drivers analysed:0
                                                              Number of injected processes analysed:0
                                                              Technologies:
                                                              • HCA enabled
                                                              • EGA enabled
                                                              • HDC enabled
                                                              • AMSI enabled
                                                              Analysis Mode:default
                                                              Analysis stop reason:Timeout
                                                              Detection:MAL
                                                              Classification:mal100.troj.evad.winEXE@31/11@0/0
                                                              EGA Information:Failed
                                                              HDC Information:Failed
                                                              HCA Information:
                                                              • Successful, ratio: 98%
                                                              • Number of executed functions: 0
                                                              • Number of non-executed functions: 0
                                                              Cookbook Comments:
                                                              • Adjust boot time
                                                              • Enable AMSI
                                                              • Found application associated with file extension: .exe
                                                              Warnings:
                                                              Show All
                                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
                                                              • Not all processes where analyzed, report is missing behavior information
                                                              • Report creation exceeded maximum time and may have missing behavior and disassembly information.
                                                              • Report creation exceeded maximum time and may have missing disassembly code information.
                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                              • Report size getting too big, too many NtQueryValueKey calls found.

                                                              Simulations

                                                              Behavior and APIs

                                                              TimeTypeDescription
                                                              20:41:29API Interceptor578x Sleep call for process: Purchase Order-568149.exe modified
                                                              20:42:09AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run YYtJku C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                                                              20:42:17AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run YYtJku C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                                                              20:42:22API Interceptor133x Sleep call for process: YYtJku.exe modified

                                                              Joe Sandbox View / Context

                                                              IPs

                                                              No context

                                                              Domains

                                                              No context

                                                              ASN

                                                              No context

                                                              JA3 Fingerprints

                                                              No context

                                                              Dropped Files

                                                              No context

                                                              Created / dropped Files

                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Order-568149.exe.log
                                                              Process:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              File Type:ASCII text, with CRLF line terminators
                                                              Category:modified
                                                              Size (bytes):1216
                                                              Entropy (8bit):5.355304211458859
                                                              Encrypted:false
                                                              SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
                                                              MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                                              SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                                              SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                                              SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                                              Malicious:true
                                                              Reputation:unknown
                                                              Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\YYtJku.exe.log
                                                              Process:C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                                                              File Type:ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):1216
                                                              Entropy (8bit):5.355304211458859
                                                              Encrypted:false
                                                              SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
                                                              MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                                              SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                                              SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                                              SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                                              Malicious:false
                                                              Reputation:unknown
                                                              Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21
                                                              C:\Users\user\AppData\Local\Temp\tmp31EE.tmp
                                                              Process:C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):1653
                                                              Entropy (8bit):5.167460387336423
                                                              Encrypted:false
                                                              SSDEEP:24:2dH4+SEqC/S7h2ulNMFp2O/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKB3Fbtn:cbha7JlNQV/rydbz9I3YODOLNdq3n5
                                                              MD5:0F0234C5E88A75551290F5AE18781C63
                                                              SHA1:95BCC8204FBBB833D17A76D18F5966A1BDBD0B49
                                                              SHA-256:5444BB2D5C248215AD57A7519EA1CD1726B2809A3BFC6C439483383416EC0B9A
                                                              SHA-512:B6BB6CF7DA41783FC9FC96AF57D846403EE4A4AB4CB4B2ACD1FD75E81CC008988B3C1D3A2B29A57ABF3EA38488AF4A47CC6C70DFD12A0F8B9F69BB029A447E33
                                                              Malicious:false
                                                              Reputation:unknown
                                                              Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvail
                                                              C:\Users\user\AppData\Local\Temp\tmp5526.tmp
                                                              Process:C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:24:2dH4+SEqC/S7h2ulNMFp2O/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKB3Fbtn:cbha7JlNQV/rydbz9I3YODOLNdq3n5
                                                              MD5:0F0234C5E88A75551290F5AE18781C63
                                                              SHA1:95BCC8204FBBB833D17A76D18F5966A1BDBD0B49
                                                              SHA-256:5444BB2D5C248215AD57A7519EA1CD1726B2809A3BFC6C439483383416EC0B9A
                                                              SHA-512:B6BB6CF7DA41783FC9FC96AF57D846403EE4A4AB4CB4B2ACD1FD75E81CC008988B3C1D3A2B29A57ABF3EA38488AF4A47CC6C70DFD12A0F8B9F69BB029A447E33
                                                              Malicious:false
                                                              Reputation:unknown
                                                              Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvail
                                                              C:\Users\user\AppData\Local\Temp\tmp5CCB.tmp
                                                              Process:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):1653
                                                              Entropy (8bit):5.167460387336423
                                                              Encrypted:false
                                                              SSDEEP:24:2dH4+SEqC/S7h2ulNMFp2O/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKB3Fbtn:cbha7JlNQV/rydbz9I3YODOLNdq3n5
                                                              MD5:0F0234C5E88A75551290F5AE18781C63
                                                              SHA1:95BCC8204FBBB833D17A76D18F5966A1BDBD0B49
                                                              SHA-256:5444BB2D5C248215AD57A7519EA1CD1726B2809A3BFC6C439483383416EC0B9A
                                                              SHA-512:B6BB6CF7DA41783FC9FC96AF57D846403EE4A4AB4CB4B2ACD1FD75E81CC008988B3C1D3A2B29A57ABF3EA38488AF4A47CC6C70DFD12A0F8B9F69BB029A447E33
                                                              Malicious:true
                                                              Reputation:unknown
                                                              Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvail
                                                              C:\Users\user\AppData\Local\Temp\tmp8013.tmp
                                                              Process:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                              Category:modified
                                                              Size (bytes):1658
                                                              Entropy (8bit):5.162387295213227
                                                              Encrypted:false
                                                              SSDEEP:24:2dH4+SEqC/S7h2ulNMFp2O/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKB3Jtn:cbha7JlNQV/rydbz9I3YODOLNdq3Z
                                                              MD5:C273A4C55231177FD5797CC6408B118D
                                                              SHA1:E2150489D6EA72A4F8C5EC4BAA4A74B9AA26511F
                                                              SHA-256:AA5C261A8B2AF9FAF44C0687688AE84534BC157B116A2AC52D46A51108A29D21
                                                              SHA-512:D42A6703F685714EA6D057AAC239A82A45B9FB185AAC5B424F063149F5599FFA89DFB4AE72C0725B0175A9AD6D0E6E8A0FEA78391418CF222DE887B8E10EDF24
                                                              Malicious:false
                                                              Reputation:unknown
                                                              Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvail
                                                              C:\Users\user\AppData\Roaming\RQqbzWGR.exe
                                                              Process:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):1958400
                                                              Entropy (8bit):7.426284873219883
                                                              Encrypted:false
                                                              SSDEEP:49152:kMJyo1U3GlbQA1obnz3Mc7Dcd/k7AK1j:l9qSov3Mc7DX
                                                              MD5:83F1AFD58BF104CB33FACC556D7BAE89
                                                              SHA1:4D57EA68149DA873D3DA6DE49241D1CD33F1B3F3
                                                              SHA-256:F0A5918DE0509BE93FFA64BE5E74942989FA8ACD94B34B6659F479D22ABAB0CA
                                                              SHA-512:54DC3D6AAE0401EBE1DEE9F98FAA653127D93F5C0BFE2C86C68D4F97E468F344FDBE92F2BB0040A74CF486D1476AACE27974DA3C37507A85CA7F00DA76C187E0
                                                              Malicious:true
                                                              Antivirus:
                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                              Reputation:unknown
                                                              Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....|.a..............P.................. ... ....@.. .......................@............@.................................X...O.... ....................... ....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc....... ......................@..B........................H.......L....8......M...X..../............................................(....*&..(.....*.s.........s ........s!........s"........s#........*...0...........~....o$....+..*.0...........~....o%....+..*.0...........~....o&....+..*.0...........~....o'....+..*.0...........~....o(....+..*.0..<........~.....().....,!r...p.....(*...o+...s,............~.....+..*.0...........~.....+..*".......*.0..&........(....r%..p~....o-...(......t$....+..*Vs....(/...t.........*..(0...*.0..........
                                                              C:\Users\user\AppData\Roaming\RQqbzWGR.exe:Zone.Identifier
                                                              Process:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              File Type:ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):26
                                                              Entropy (8bit):3.95006375643621
                                                              Encrypted:false
                                                              SSDEEP:3:ggPYV:rPYV
                                                              MD5:187F488E27DB4AF347237FE461A079AD
                                                              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                              Malicious:true
                                                              Reputation:unknown
                                                              Preview: [ZoneTransfer]....ZoneId=0
                                                              C:\Users\user\AppData\Roaming\TxWUEITvoDwYs.exe
                                                              Process:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):1958400
                                                              Entropy (8bit):7.426284873219883
                                                              Encrypted:false
                                                              SSDEEP:49152:kMJyo1U3GlbQA1obnz3Mc7Dcd/k7AK1j:l9qSov3Mc7DX
                                                              MD5:83F1AFD58BF104CB33FACC556D7BAE89
                                                              SHA1:4D57EA68149DA873D3DA6DE49241D1CD33F1B3F3
                                                              SHA-256:F0A5918DE0509BE93FFA64BE5E74942989FA8ACD94B34B6659F479D22ABAB0CA
                                                              SHA-512:54DC3D6AAE0401EBE1DEE9F98FAA653127D93F5C0BFE2C86C68D4F97E468F344FDBE92F2BB0040A74CF486D1476AACE27974DA3C37507A85CA7F00DA76C187E0
                                                              Malicious:true
                                                              Antivirus:
                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                              Reputation:unknown
                                                              Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....|.a..............P.................. ... ....@.. .......................@............@.................................X...O.... ....................... ....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc....... ......................@..B........................H.......L....8......M...X..../............................................(....*&..(.....*.s.........s ........s!........s"........s#........*...0...........~....o$....+..*.0...........~....o%....+..*.0...........~....o&....+..*.0...........~....o'....+..*.0...........~....o(....+..*.0..<........~.....().....,!r...p.....(*...o+...s,............~.....+..*.0...........~.....+..*".......*.0..&........(....r%..p~....o-...(......t$....+..*Vs....(/...t.........*..(0...*.0..........
                                                              C:\Users\user\AppData\Roaming\TxWUEITvoDwYs.exe:Zone.Identifier
                                                              Process:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              File Type:ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):26
                                                              Entropy (8bit):3.95006375643621
                                                              Encrypted:false
                                                              SSDEEP:3:ggPYV:rPYV
                                                              MD5:187F488E27DB4AF347237FE461A079AD
                                                              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                              Malicious:true
                                                              Reputation:unknown
                                                              Preview: [ZoneTransfer]....ZoneId=0
                                                              C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                                                              Process:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):1958400
                                                              Entropy (8bit):7.426284873219883
                                                              Encrypted:false
                                                              SSDEEP:49152:kMJyo1U3GlbQA1obnz3Mc7Dcd/k7AK1j:l9qSov3Mc7DX
                                                              MD5:83F1AFD58BF104CB33FACC556D7BAE89
                                                              SHA1:4D57EA68149DA873D3DA6DE49241D1CD33F1B3F3
                                                              SHA-256:F0A5918DE0509BE93FFA64BE5E74942989FA8ACD94B34B6659F479D22ABAB0CA
                                                              SHA-512:54DC3D6AAE0401EBE1DEE9F98FAA653127D93F5C0BFE2C86C68D4F97E468F344FDBE92F2BB0040A74CF486D1476AACE27974DA3C37507A85CA7F00DA76C187E0
                                                              Malicious:true
                                                              Antivirus:
                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                              Reputation:unknown
                                                              Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....|.a..............P.................. ... ....@.. .......................@............@.................................X...O.... ....................... ....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc....... ......................@..B........................H.......L....8......M...X..../............................................(....*&..(.....*.s.........s ........s!........s"........s#........*...0...........~....o$....+..*.0...........~....o%....+..*.0...........~....o&....+..*.0...........~....o'....+..*.0...........~....o(....+..*.0..<........~.....().....,!r...p.....(*...o+...s,............~.....+..*.0...........~.....+..*".......*.0..&........(....r%..p~....o-...(......t$....+..*Vs....(/...t.........*..(0...*.0..........
                                                              C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe:Zone.Identifier
                                                              Process:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              File Type:ASCII text, with CRLF line terminators
                                                              Category:modified
                                                              Size (bytes):26
                                                              Entropy (8bit):3.95006375643621
                                                              Encrypted:false
                                                              SSDEEP:3:ggPYV:rPYV
                                                              MD5:187F488E27DB4AF347237FE461A079AD
                                                              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                              Malicious:true
                                                              Reputation:unknown
                                                              Preview: [ZoneTransfer]....ZoneId=0

                                                              Static File Info

                                                              General

                                                              File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                              Entropy (8bit):7.426284873219883
                                                              TrID:
                                                              • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                              • Win32 Executable (generic) a (10002005/4) 49.78%
                                                              • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                              • Generic Win/DOS Executable (2004/3) 0.01%
                                                              • DOS Executable Generic (2002/1) 0.01%
                                                              File name:Purchase Order-568149.exe
                                                              File size:1958400
                                                              MD5:83f1afd58bf104cb33facc556d7bae89
                                                              SHA1:4d57ea68149da873d3da6de49241d1cd33f1b3f3
                                                              SHA256:f0a5918de0509be93ffa64be5e74942989fa8acd94b34b6659f479d22abab0ca
                                                              SHA512:54dc3d6aae0401ebe1dee9f98faa653127d93f5c0bfe2c86c68d4f97e468f344fdbe92f2bb0040a74cf486d1476aace27974da3c37507a85ca7f00da76c187e0
                                                              SSDEEP:49152:kMJyo1U3GlbQA1obnz3Mc7Dcd/k7AK1j:l9qSov3Mc7DX
                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....|.a..............P.................. ... ....@.. .......................@............@................................

                                                              File Icon

                                                              Icon Hash:f0c2a07179b396e8

                                                              Static PE Info

                                                              General

                                                              Entrypoint:0x5a0aaa
                                                              Entrypoint Section:.text
                                                              Digitally signed:false
                                                              Imagebase:0x400000
                                                              Subsystem:windows gui
                                                              Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                              DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                              Time Stamp:0x61097C8D [Tue Aug 3 17:27:41 2021 UTC]
                                                              TLS Callbacks:
                                                              CLR (.Net) Version:v4.0.30319
                                                              OS Version Major:4
                                                              OS Version Minor:0
                                                              File Version Major:4
                                                              File Version Minor:0
                                                              Subsystem Version Major:4
                                                              Subsystem Version Minor:0
                                                              Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                              Entrypoint Preview

                                                              Instruction
                                                              jmp dword ptr [00402000h]
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al

                                                              Data Directories

                                                              NameVirtual AddressVirtual Size Is in Section
                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x1a0a580x4f.text
                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x1a20000x3f098.rsrc
                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x1e20000xc.reloc
                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                              Sections

                                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                              .text0x20000x19eab00x19ec00False0.747485896059PGP symmetric key encrypted data - Plaintext or unencrypted data7.43251327113IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                              .rsrc0x1a20000x3f0980x3f200False0.744009127475data7.06543166408IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                              .reloc0x1e20000xc0x200False0.044921875data0.0815394123432IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                              Resources

                                                              NameRVASizeTypeLanguageCountry
                                                              RT_ICON0x1a21e00x103e6PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                                              RT_ICON0x1b25d80x10318PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                                              RT_ICON0x1c29000x10828dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
                                                              RT_ICON0x1d31380x94a8data
                                                              RT_ICON0x1dc5f00x25a8data
                                                              RT_ICON0x1deba80x10a8data
                                                              RT_ICON0x1dfc600x988data
                                                              RT_ICON0x1e05f80x468GLS_BINARY_LSB_FIRST
                                                              RT_GROUP_ICON0x1e0a700x76data
                                                              RT_VERSION0x1e0af80x3a0data
                                                              RT_MANIFEST0x1e0ea80x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                              Imports

                                                              DLLImport
                                                              mscoree.dll_CorExeMain

                                                              Version Infos

                                                              DescriptionData
                                                              Translation0x0000 0x04b0
                                                              LegalCopyrightCopyright Bloodknight Studios, Slayin
                                                              Assembly Version1.0.0.9
                                                              InternalNameDefaultBind.exe
                                                              FileVersion1.0.0.9
                                                              CompanyNameBloodknight Studios
                                                              LegalTrademarks
                                                              CommentsCharacter Stat Calc
                                                              ProductNameStatCalc
                                                              ProductVersion1.0.0.9
                                                              FileDescriptionAstonia Calc
                                                              OriginalFilenameDefaultBind.exe

                                                              Network Behavior

                                                              No network behavior found

                                                              Code Manipulations

                                                              Statistics

                                                              Behavior

                                                              Click to jump to process

                                                              System Behavior

                                                              Analysis Process: Purchase Order-568149.exe PID: 3452 Parent PID: 5732

                                                              General

                                                              Start time:20:41:18
                                                              Start date:03/08/2021
                                                              Path:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:'C:\Users\user\Desktop\Purchase Order-568149.exe'
                                                              Imagebase:0xca0000
                                                              File size:1958400 bytes
                                                              MD5 hash:83F1AFD58BF104CB33FACC556D7BAE89
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:.Net C# or VB.NET
                                                              Yara matches:
                                                              • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.368950363.0000000003568000.00000004.00000001.sdmp, Author: Joe Security
                                                              Reputation:low

                                                              Analysis Process: schtasks.exe PID: 2520 Parent PID: 3452

                                                              General

                                                              Start time:20:41:31
                                                              Start date:03/08/2021
                                                              Path:C:\Windows\SysWOW64\schtasks.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RQqbzWGR' /XML 'C:\Users\user\AppData\Local\Temp\tmp5CCB.tmp'
                                                              Imagebase:0xa50000
                                                              File size:185856 bytes
                                                              MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high

                                                              Analysis Process: conhost.exe PID: 5668 Parent PID: 2520

                                                              General

                                                              Start time:20:41:32
                                                              Start date:03/08/2021
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff61de10000
                                                              File size:625664 bytes
                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high

                                                              Analysis Process: Purchase Order-568149.exe PID: 2796 Parent PID: 3452

                                                              General

                                                              Start time:20:41:33
                                                              Start date:03/08/2021
                                                              Path:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              Imagebase:0x650000
                                                              File size:1958400 bytes
                                                              MD5 hash:83F1AFD58BF104CB33FACC556D7BAE89
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:.Net C# or VB.NET
                                                              Yara matches:
                                                              • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.390113039.0000000003B49000.00000004.00000001.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000007.00000002.390113039.0000000003B49000.00000004.00000001.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000007.00000002.389374922.0000000002CCB000.00000004.00000001.sdmp, Author: Joe Security
                                                              Reputation:low

                                                              Analysis Process: schtasks.exe PID: 5012 Parent PID: 2796

                                                              General

                                                              Start time:20:41:41
                                                              Start date:03/08/2021
                                                              Path:C:\Windows\SysWOW64\schtasks.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TxWUEITvoDwYs' /XML 'C:\Users\user\AppData\Local\Temp\tmp8013.tmp'
                                                              Imagebase:0xa50000
                                                              File size:185856 bytes
                                                              MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high

                                                              Analysis Process: conhost.exe PID: 5824 Parent PID: 5012

                                                              General

                                                              Start time:20:41:42
                                                              Start date:03/08/2021
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff61de10000
                                                              File size:625664 bytes
                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high

                                                              Analysis Process: Purchase Order-568149.exe PID: 3916 Parent PID: 2796

                                                              General

                                                              Start time:20:41:43
                                                              Start date:03/08/2021
                                                              Path:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              Imagebase:0x3a0000
                                                              File size:1958400 bytes
                                                              MD5 hash:83F1AFD58BF104CB33FACC556D7BAE89
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:low

                                                              Analysis Process: Purchase Order-568149.exe PID: 3728 Parent PID: 2796

                                                              General

                                                              Start time:20:41:44
                                                              Start date:03/08/2021
                                                              Path:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:C:\Users\user\Desktop\Purchase Order-568149.exe
                                                              Imagebase:0x790000
                                                              File size:1958400 bytes
                                                              MD5 hash:83F1AFD58BF104CB33FACC556D7BAE89
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:.Net C# or VB.NET
                                                              Yara matches:
                                                              • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.596505185.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000B.00000002.596505185.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.604354638.0000000002D81000.00000004.00000001.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.604354638.0000000002D81000.00000004.00000001.sdmp, Author: Joe Security
                                                              Reputation:low

                                                              Analysis Process: YYtJku.exe PID: 5800 Parent PID: 3440

                                                              General

                                                              Start time:20:42:18
                                                              Start date:03/08/2021
                                                              Path:C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:'C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe'
                                                              Imagebase:0xf70000
                                                              File size:1958400 bytes
                                                              MD5 hash:83F1AFD58BF104CB33FACC556D7BAE89
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:.Net C# or VB.NET
                                                              Yara matches:
                                                              • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000014.00000002.485090142.00000000039F8000.00000004.00000001.sdmp, Author: Joe Security
                                                              Antivirus matches:
                                                              • Detection: 100%, Joe Sandbox ML
                                                              Reputation:low

                                                              Analysis Process: schtasks.exe PID: 5788 Parent PID: 5800

                                                              General

                                                              Start time:20:42:25
                                                              Start date:03/08/2021
                                                              Path:C:\Windows\SysWOW64\schtasks.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RQqbzWGR' /XML 'C:\Users\user\AppData\Local\Temp\tmp31EE.tmp'
                                                              Imagebase:0xa50000
                                                              File size:185856 bytes
                                                              MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high

                                                              Analysis Process: conhost.exe PID: 1676 Parent PID: 5788

                                                              General

                                                              Start time:20:42:25
                                                              Start date:03/08/2021
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff61de10000
                                                              File size:625664 bytes
                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high

                                                              Analysis Process: YYtJku.exe PID: 5964 Parent PID: 3440

                                                              General

                                                              Start time:20:42:26
                                                              Start date:03/08/2021
                                                              Path:C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:'C:\Users\user\AppData\Roaming\YYtJku\YYtJku.exe'
                                                              Imagebase:0x990000
                                                              File size:1958400 bytes
                                                              MD5 hash:83F1AFD58BF104CB33FACC556D7BAE89
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:.Net C# or VB.NET
                                                              Yara matches:
                                                              • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000019.00000002.509309042.0000000003188000.00000004.00000001.sdmp, Author: Joe Security
                                                              Reputation:low

                                                              Disassembly

                                                              Code Analysis

                                                              Reset < >