Edit tour

Windows Analysis Report
Purchase Order.exe

Overview

General Information

Sample Name:	Purchase Order.exe
Analysis ID:	562512
MD5:	13d83a3812ec316654034e15f506aa06
SHA1:	9d4f2afe54ca9b3cd31912b10dcc288b6696f3ea
SHA256:	2518a50e9483da255cb061cb5eb966f41f39daf912341e7cf4442da4b362da8c
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

Multi AV Scanner detection for dropped file

Initial sample is a PE file and has a suspicious name

Modifies the hosts file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Sigma detected: Suspicius Add Task From User AppData Temp

Machine Learning detection for sample

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Sigma detected: Autorun Keys Modification

Classification

Process Tree

System is w10x64

Purchase Order.exe (PID: 4872 cmdline: "C:\Users\user\Desktop\Purchase Order.exe" MD5: 13D83A3812EC316654034E15F506AA06)

schtasks.exe (PID: 6592 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmp8E57.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Purchase Order.exe (PID: 1880 cmdline: {path} MD5: 13D83A3812EC316654034E15F506AA06)

Purchase Order.exe (PID: 4848 cmdline: {path} MD5: 13D83A3812EC316654034E15F506AA06)

tKZVPq.exe (PID: 5416 cmdline: "C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe" MD5: 13D83A3812EC316654034E15F506AA06)

schtasks.exe (PID: 4972 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmpACD7.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

tKZVPq.exe (PID: 3732 cmdline: {path} MD5: 13D83A3812EC316654034E15F506AA06)

tKZVPq.exe (PID: 3416 cmdline: "C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe" MD5: 13D83A3812EC316654034E15F506AA06)

schtasks.exe (PID: 6192 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmpD0CA.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 2532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

tKZVPq.exe (PID: 6856 cmdline: {path} MD5: 13D83A3812EC316654034E15F506AA06)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "dattaprasad@jkudyog.com", "Password": "%$#@lkjhgfdsa", "Host": "mail.jkudyog.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000000.377300432.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000000.377300432.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000007.00000000.376818442.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000000.376818442.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x2134:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time 0x2c7a:$m3: >{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\WScript.ShellRegReadg401 0x2255:$m5: \WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera
00000007.00000000.378482840.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000000.378482840.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000017.00000000.534932278.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000017.00000000.534932278.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000013.00000002.554080549.0000000003A11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.554080549.0000000003A11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000007.00000000.377959898.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000000.377959898.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000017.00000000.535514668.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000017.00000000.535514668.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000017.00000000.534286456.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000017.00000000.534286456.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000007.00000002.566073924.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.566073924.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.386598355.00000000040FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.386598355.00000000040FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000017.00000000.536182206.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000017.00000000.536182206.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.384446432.0000000003E41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.384446432.0000000003E41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000007.00000002.569789706.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.569789706.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.569789706.0000000002C11000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x20f8:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time 0x2c3e:$m3: >{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\WScript.ShellRegReadg401 0x2219:$m5: \WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera
00000017.00000002.567278813.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000017.00000002.567278813.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000011.00000002.544948329.0000000003401000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.544948329.0000000003401000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: Purchase Order.exe PID: 4872	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Purchase Order.exe PID: 4872	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Purchase Order.exe PID: 4848	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Purchase Order.exe PID: 4848	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Purchase Order.exe PID: 4848	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x3fb2:$s1: get_kbok 0x16438:$s1: get_kbok 0x4832:$s2: get_CHoo 0x16cb8:$s2: get_CHoo 0x53e5:$s3: set_passwordIsSet 0x1786b:$s3: set_passwordIsSet 0x3e5e:$s4: get_enableLog 0x162e4:$s4: get_enableLog 0x32c2:$g1: get_Clipboard 0x15748:$g1: get_Clipboard 0x32d0:$g2: get_Keyboard 0x15756:$g2: get_Keyboard 0x32dd:$g3: get_Password 0x15763:$g3: get_Password 0x470c:$g4: get_CtrlKeyDown 0x16b92:$g4: get_CtrlKeyDown 0x471c:$g5: get_ShiftKeyDown 0x16ba2:$g5: get_ShiftKeyDown 0x472d:$g6: get_AltKeyDown 0x16bb3:$g6: get_AltKeyDown 0x27255:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time
Process Memory Space: tKZVPq.exe PID: 5416	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: tKZVPq.exe PID: 5416	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: tKZVPq.exe PID: 3416	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: tKZVPq.exe PID: 3416	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: tKZVPq.exe PID: 3732	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: tKZVPq.exe PID: 3732	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: tKZVPq.exe PID: 3732	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x213b4:$s1: get_kbok 0x2c513:$s1: get_kbok 0x21c34:$s2: get_CHoo 0x2cd93:$s2: get_CHoo 0x227e7:$s3: set_passwordIsSet 0x2d946:$s3: set_passwordIsSet 0x21260:$s4: get_enableLog 0x2c3bf:$s4: get_enableLog 0x206c4:$g1: get_Clipboard 0x2b823:$g1: get_Clipboard 0x206d2:$g2: get_Keyboard 0x2b831:$g2: get_Keyboard 0x206df:$g3: get_Password 0x2b83e:$g3: get_Password 0x21b0e:$g4: get_CtrlKeyDown 0x2cc6d:$g4: get_CtrlKeyDown 0x21b1e:$g5: get_ShiftKeyDown 0x2cc7d:$g5: get_ShiftKeyDown 0x21b2f:$g6: get_AltKeyDown 0x2cc8e:$g6: get_AltKeyDown 0x547:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time
Click to see the 41 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.0.Purchase Order.exe.400000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.0.Purchase Order.exe.400000.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
7.0.Purchase Order.exe.400000.6.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e3b:$s1: get_kbok 0x3176f:$s2: get_CHoo 0x323e2:$s3: set_passwordIsSet 0x30c3f:$s4: get_enableLog 0x35312:$s8: torbrowser 0x33cee:$s10: logins 0x3366d:$s11: credential 0x30026:$g1: get_Clipboard 0x30034:$g2: get_Keyboard 0x30041:$g3: get_Password 0x3161d:$g4: get_CtrlKeyDown 0x3162d:$g5: get_ShiftKeyDown 0x3163e:$g6: get_AltKeyDown
7.2.Purchase Order.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.2.Purchase Order.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
7.2.Purchase Order.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e3b:$s1: get_kbok 0x3176f:$s2: get_CHoo 0x323e2:$s3: set_passwordIsSet 0x30c3f:$s4: get_enableLog 0x35312:$s8: torbrowser 0x33cee:$s10: logins 0x3366d:$s11: credential 0x30026:$g1: get_Clipboard 0x30034:$g2: get_Keyboard 0x30041:$g3: get_Password 0x3161d:$g4: get_CtrlKeyDown 0x3162d:$g5: get_ShiftKeyDown 0x3163e:$g6: get_AltKeyDown
0.2.Purchase Order.exe.3fff900.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Purchase Order.exe.3fff900.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Purchase Order.exe.3fff900.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x2f03b:$s1: get_kbok 0x2f96f:$s2: get_CHoo 0x305e2:$s3: set_passwordIsSet 0x2ee3f:$s4: get_enableLog 0x33512:$s8: torbrowser 0x31eee:$s10: logins 0x3186d:$s11: credential 0x2e226:$g1: get_Clipboard 0x2e234:$g2: get_Keyboard 0x2e241:$g3: get_Password 0x2f81d:$g4: get_CtrlKeyDown 0x2f82d:$g5: get_ShiftKeyDown 0x2f83e:$g6: get_AltKeyDown
23.0.tKZVPq.exe.400000.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
23.0.tKZVPq.exe.400000.12.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
23.0.tKZVPq.exe.400000.12.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e3b:$s1: get_kbok 0x3176f:$s2: get_CHoo 0x323e2:$s3: set_passwordIsSet 0x30c3f:$s4: get_enableLog 0x35312:$s8: torbrowser 0x33cee:$s10: logins 0x3366d:$s11: credential 0x30026:$g1: get_Clipboard 0x30034:$g2: get_Keyboard 0x30041:$g3: get_Password 0x3161d:$g4: get_CtrlKeyDown 0x3162d:$g5: get_ShiftKeyDown 0x3163e:$g6: get_AltKeyDown
7.0.Purchase Order.exe.400000.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.0.Purchase Order.exe.400000.10.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
7.0.Purchase Order.exe.400000.10.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e3b:$s1: get_kbok 0x3176f:$s2: get_CHoo 0x323e2:$s3: set_passwordIsSet 0x30c3f:$s4: get_enableLog 0x35312:$s8: torbrowser 0x33cee:$s10: logins 0x3366d:$s11: credential 0x30026:$g1: get_Clipboard 0x30034:$g2: get_Keyboard 0x30041:$g3: get_Password 0x3161d:$g4: get_CtrlKeyDown 0x3162d:$g5: get_ShiftKeyDown 0x3163e:$g6: get_AltKeyDown
17.2.tKZVPq.exe.35bf900.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.tKZVPq.exe.35bf900.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
17.2.tKZVPq.exe.35bf900.2.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e3b:$s1: get_kbok 0x66e5b:$s1: get_kbok 0x3176f:$s2: get_CHoo 0x6778f:$s2: get_CHoo 0x323e2:$s3: set_passwordIsSet 0x68402:$s3: set_passwordIsSet 0x30c3f:$s4: get_enableLog 0x66c5f:$s4: get_enableLog 0x35312:$s8: torbrowser 0x6b332:$s8: torbrowser 0x33cee:$s10: logins 0x69d0e:$s10: logins 0x3366d:$s11: credential 0x6968d:$s11: credential 0x30026:$g1: get_Clipboard 0x66046:$g1: get_Clipboard 0x30034:$g2: get_Keyboard 0x66054:$g2: get_Keyboard 0x30041:$g3: get_Password 0x66061:$g3: get_Password 0x3161d:$g4: get_CtrlKeyDown
7.0.Purchase Order.exe.400000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.0.Purchase Order.exe.400000.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
7.0.Purchase Order.exe.400000.8.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e3b:$s1: get_kbok 0x3176f:$s2: get_CHoo 0x323e2:$s3: set_passwordIsSet 0x30c3f:$s4: get_enableLog 0x35312:$s8: torbrowser 0x33cee:$s10: logins 0x3366d:$s11: credential 0x30026:$g1: get_Clipboard 0x30034:$g2: get_Keyboard 0x30041:$g3: get_Password 0x3161d:$g4: get_CtrlKeyDown 0x3162d:$g5: get_ShiftKeyDown 0x3163e:$g6: get_AltKeyDown
17.2.tKZVPq.exe.35448e0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.tKZVPq.exe.35448e0.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
17.2.tKZVPq.exe.35448e0.3.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0xabe5b:$s1: get_kbok 0xe1e7b:$s1: get_kbok 0xac78f:$s2: get_CHoo 0xe27af:$s2: get_CHoo 0xad402:$s3: set_passwordIsSet 0xe3422:$s3: set_passwordIsSet 0xabc5f:$s4: get_enableLog 0xe1c7f:$s4: get_enableLog 0xb0332:$s8: torbrowser 0xe6352:$s8: torbrowser 0xaed0e:$s10: logins 0xe4d2e:$s10: logins 0xae68d:$s11: credential 0xe46ad:$s11: credential 0xab046:$g1: get_Clipboard 0xe1066:$g1: get_Clipboard 0xab054:$g2: get_Keyboard 0xe1074:$g2: get_Keyboard 0xab061:$g3: get_Password 0xe1081:$g3: get_Password 0xac63d:$g4: get_CtrlKeyDown
23.0.tKZVPq.exe.400000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
23.0.tKZVPq.exe.400000.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
23.0.tKZVPq.exe.400000.6.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e3b:$s1: get_kbok 0x3176f:$s2: get_CHoo 0x323e2:$s3: set_passwordIsSet 0x30c3f:$s4: get_enableLog 0x35312:$s8: torbrowser 0x33cee:$s10: logins 0x3366d:$s11: credential 0x30026:$g1: get_Clipboard 0x30034:$g2: get_Keyboard 0x30041:$g3: get_Password 0x3161d:$g4: get_CtrlKeyDown 0x3162d:$g5: get_ShiftKeyDown 0x3163e:$g6: get_AltKeyDown
23.2.tKZVPq.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
23.2.tKZVPq.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
23.2.tKZVPq.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e3b:$s1: get_kbok 0x3176f:$s2: get_CHoo 0x323e2:$s3: set_passwordIsSet 0x30c3f:$s4: get_enableLog 0x35312:$s8: torbrowser 0x33cee:$s10: logins 0x3366d:$s11: credential 0x30026:$g1: get_Clipboard 0x30034:$g2: get_Keyboard 0x30041:$g3: get_Password 0x3161d:$g4: get_CtrlKeyDown 0x3162d:$g5: get_ShiftKeyDown 0x3163e:$g6: get_AltKeyDown
23.0.tKZVPq.exe.400000.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
23.0.tKZVPq.exe.400000.10.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
23.0.tKZVPq.exe.400000.10.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e3b:$s1: get_kbok 0x3176f:$s2: get_CHoo 0x323e2:$s3: set_passwordIsSet 0x30c3f:$s4: get_enableLog 0x35312:$s8: torbrowser 0x33cee:$s10: logins 0x3366d:$s11: credential 0x30026:$g1: get_Clipboard 0x30034:$g2: get_Keyboard 0x30041:$g3: get_Password 0x3161d:$g4: get_CtrlKeyDown 0x3162d:$g5: get_ShiftKeyDown 0x3163e:$g6: get_AltKeyDown
19.2.tKZVPq.exe.3bcf900.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.2.tKZVPq.exe.3bcf900.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
19.2.tKZVPq.exe.3bcf900.3.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x2f03b:$s1: get_kbok 0x2f96f:$s2: get_CHoo 0x305e2:$s3: set_passwordIsSet 0x2ee3f:$s4: get_enableLog 0x33512:$s8: torbrowser 0x31eee:$s10: logins 0x3186d:$s11: credential 0x2e226:$g1: get_Clipboard 0x2e234:$g2: get_Keyboard 0x2e241:$g3: get_Password 0x2f81d:$g4: get_CtrlKeyDown 0x2f82d:$g5: get_ShiftKeyDown 0x2f83e:$g6: get_AltKeyDown
17.2.tKZVPq.exe.246817c.1.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x381070:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x3810b4:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x3810fc:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x381388:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x3813ec:$s2: Set-MpPreference -DisableArchiveScanning $true 0x381444:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x38149c:$s4: Set-MpPreference -DisableScriptScanning $true 0x3814e8:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x381528:$s6: Set-MpPreference -MAPSReporting 0 0x381574:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x3815cc:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x38161c:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x38166c:$s10: Set-MpPreference -SevereThreatDefaultAction 6
0.2.Purchase Order.exe.3fff900.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Purchase Order.exe.3fff900.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Purchase Order.exe.3fff900.4.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30bde:$s2: GetPrivateProfileString 0x3037d:$s3: get_OSFullName 0x30c90:$s4: get_PasswordHash 0xd1316:$s5: remove_Key 0x3262a:$s6: FtpWebRequest 0x33cee:$s7: logins
0.2.Purchase Order.exe.3fff900.4.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e3b:$s1: get_kbok 0x3176f:$s2: get_CHoo 0x323e2:$s3: set_passwordIsSet 0x30c3f:$s4: get_enableLog 0x35312:$s8: torbrowser 0x33cee:$s10: logins 0x3366d:$s11: credential 0x30026:$g1: get_Clipboard 0x30034:$g2: get_Keyboard 0x30041:$g3: get_Password 0x3161d:$g4: get_CtrlKeyDown 0x3162d:$g5: get_ShiftKeyDown 0x3163e:$g6: get_AltKeyDown
7.0.Purchase Order.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.0.Purchase Order.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
7.0.Purchase Order.exe.400000.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e3b:$s1: get_kbok 0x3176f:$s2: get_CHoo 0x323e2:$s3: set_passwordIsSet 0x30c3f:$s4: get_enableLog 0x35312:$s8: torbrowser 0x33cee:$s10: logins 0x3366d:$s11: credential 0x30026:$g1: get_Clipboard 0x30034:$g2: get_Keyboard 0x30041:$g3: get_Password 0x3161d:$g4: get_CtrlKeyDown 0x3162d:$g5: get_ShiftKeyDown 0x3163e:$g6: get_AltKeyDown
7.0.Purchase Order.exe.400000.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.0.Purchase Order.exe.400000.12.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
7.0.Purchase Order.exe.400000.12.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e3b:$s1: get_kbok 0x3176f:$s2: get_CHoo 0x323e2:$s3: set_passwordIsSet 0x30c3f:$s4: get_enableLog 0x35312:$s8: torbrowser 0x33cee:$s10: logins 0x3366d:$s11: credential 0x30026:$g1: get_Clipboard 0x30034:$g2: get_Keyboard 0x30041:$g3: get_Password 0x3161d:$g4: get_CtrlKeyDown 0x3162d:$g5: get_ShiftKeyDown 0x3163e:$g6: get_AltKeyDown
0.2.Purchase Order.exe.3f848e0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Purchase Order.exe.3f848e0.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Purchase Order.exe.3f848e0.3.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0xabbfe:$s2: GetPrivateProfileString 0xab39d:$s3: get_OSFullName 0xabcb0:$s4: get_PasswordHash 0x14c336:$s5: remove_Key 0xad64a:$s6: FtpWebRequest 0xaed0e:$s7: logins
0.2.Purchase Order.exe.3f848e0.3.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0xabe5b:$s1: get_kbok 0xac78f:$s2: get_CHoo 0xad402:$s3: set_passwordIsSet 0xabc5f:$s4: get_enableLog 0xb0332:$s8: torbrowser 0xaed0e:$s10: logins 0xae68d:$s11: credential 0xab046:$g1: get_Clipboard 0xab054:$g2: get_Keyboard 0xab061:$g3: get_Password 0xac63d:$g4: get_CtrlKeyDown 0xac64d:$g5: get_ShiftKeyDown 0xac65e:$g6: get_AltKeyDown
23.0.tKZVPq.exe.400000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
23.0.tKZVPq.exe.400000.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
23.0.tKZVPq.exe.400000.8.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e3b:$s1: get_kbok 0x3176f:$s2: get_CHoo 0x323e2:$s3: set_passwordIsSet 0x30c3f:$s4: get_enableLog 0x35312:$s8: torbrowser 0x33cee:$s10: logins 0x3366d:$s11: credential 0x30026:$g1: get_Clipboard 0x30034:$g2: get_Keyboard 0x30041:$g3: get_Password 0x3161d:$g4: get_CtrlKeyDown 0x3162d:$g5: get_ShiftKeyDown 0x3163e:$g6: get_AltKeyDown
17.2.tKZVPq.exe.35bf900.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.tKZVPq.exe.35bf900.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
17.2.tKZVPq.exe.35bf900.2.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x2f03b:$s1: get_kbok 0x2f96f:$s2: get_CHoo 0x305e2:$s3: set_passwordIsSet 0x2ee3f:$s4: get_enableLog 0x33512:$s8: torbrowser 0x31eee:$s10: logins 0x3186d:$s11: credential 0x2e226:$g1: get_Clipboard 0x2e234:$g2: get_Keyboard 0x2e241:$g3: get_Password 0x2f81d:$g4: get_CtrlKeyDown 0x2f82d:$g5: get_ShiftKeyDown 0x2f83e:$g6: get_AltKeyDown
23.0.tKZVPq.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
23.0.tKZVPq.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
23.0.tKZVPq.exe.400000.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e3b:$s1: get_kbok 0x3176f:$s2: get_CHoo 0x323e2:$s3: set_passwordIsSet 0x30c3f:$s4: get_enableLog 0x35312:$s8: torbrowser 0x33cee:$s10: logins 0x3366d:$s11: credential 0x30026:$g1: get_Clipboard 0x30034:$g2: get_Keyboard 0x30041:$g3: get_Password 0x3161d:$g4: get_CtrlKeyDown 0x3162d:$g5: get_ShiftKeyDown 0x3163e:$g6: get_AltKeyDown
19.2.tKZVPq.exe.3bcf900.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.2.tKZVPq.exe.3bcf900.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
19.2.tKZVPq.exe.3bcf900.3.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e3b:$s1: get_kbok 0x3176f:$s2: get_CHoo 0x323e2:$s3: set_passwordIsSet 0x30c3f:$s4: get_enableLog 0x35312:$s8: torbrowser 0x33cee:$s10: logins 0x3366d:$s11: credential 0x30026:$g1: get_Clipboard 0x30034:$g2: get_Keyboard 0x30041:$g3: get_Password 0x3161d:$g4: get_CtrlKeyDown 0x3162d:$g5: get_ShiftKeyDown 0x3163e:$g6: get_AltKeyDown
19.2.tKZVPq.exe.3b548e0.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.2.tKZVPq.exe.3b548e0.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
19.2.tKZVPq.exe.3b548e0.2.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0xabe5b:$s1: get_kbok 0xac78f:$s2: get_CHoo 0xad402:$s3: set_passwordIsSet 0xabc5f:$s4: get_enableLog 0xb0332:$s8: torbrowser 0xaed0e:$s10: logins 0xae68d:$s11: credential 0xab046:$g1: get_Clipboard 0xab054:$g2: get_Keyboard 0xab061:$g3: get_Password 0xac63d:$g4: get_CtrlKeyDown 0xac64d:$g5: get_ShiftKeyDown 0xac65e:$g6: get_AltKeyDown
0.2.Purchase Order.exe.2ea8150.1.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x381080:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x3810c4:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x38110c:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x381398:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x3813fc:$s2: Set-MpPreference -DisableArchiveScanning $true 0x381454:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x3814ac:$s4: Set-MpPreference -DisableScriptScanning $true 0x3814f8:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x381538:$s6: Set-MpPreference -MAPSReporting 0 0x381584:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x3815dc:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x38162c:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x38167c:$s10: Set-MpPreference -SevereThreatDefaultAction 6
19.2.tKZVPq.exe.2a7817c.1.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x381070:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x3810b4:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x3810fc:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x381388:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x3813ec:$s2: Set-MpPreference -DisableArchiveScanning $true 0x381444:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x38149c:$s4: Set-MpPreference -DisableScriptScanning $true 0x3814e8:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x381528:$s6: Set-MpPreference -MAPSReporting 0 0x381574:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x3815cc:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x38161c:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x38166c:$s10: Set-MpPreference -SevereThreatDefaultAction 6
Click to see the 63 entries

Sigma Overview

System Summary

Sigma detected: Suspicius Add Task From User AppData Temp

Source: Process started

Author: frack113: Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmp8E57.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmp8E57.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Purchase Order.exe" , ParentImage: C:\Users\user\Desktop\Purchase Order.exe, ParentProcessId: 4872, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmp8E57.tmp, ProcessId: 6592

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton: Data: Details: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Purchase Order.exe, ProcessId: 4848, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\tKZVPq

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 7.0.Purchase Order.exe.400000.10.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "dattaprasad@jkudyog.com", "Password": "%$#@lkjhgfdsa", "Host": "mail.jkudyog.com"}

Multi AV Scanner detection for submitted file

Source: Purchase Order.exe	Virustotal: Detection: 39%			Perma Link
Source: Purchase Order.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\TRaCepbEuy.exe	Virustotal: Detection: 39%	Perma Link
Source: C:\Users\user\AppData\Roaming\TRaCepbEuy.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Virustotal: Detection: 39%	Perma Link
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	ReversingLabs: Detection: 50%

Machine Learning detection for sample

Source: Purchase Order.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\TRaCepbEuy.exe	Joe Sandbox ML: detected

Source: 7.0.Purchase Order.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 23.2.tKZVPq.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 7.2.Purchase Order.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 23.0.tKZVPq.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 7.0.Purchase Order.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 7.0.Purchase Order.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 23.0.tKZVPq.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 23.0.tKZVPq.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 7.0.Purchase Order.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 7.0.Purchase Order.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 23.0.tKZVPq.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 23.0.tKZVPq.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8

Source: Purchase Order.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Purchase Order.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: Purchase Order.exe, 00000007.00000002.569789706.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: tKZVPq.exe, 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Purchase Order.exe, 00000000.00000002.383066984.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000011.00000002.542437762.0000000002401000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000013.00000002.552495218.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: tKZVPq.exe, 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ybzARF.com
Source: Purchase Order.exe, 00000000.00000002.384446432.0000000003E41000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000000.00000002.386598355.00000000040FB000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000007.00000000.377300432.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Purchase Order.exe, 00000007.00000000.376818442.0000000000402000.00000040.00000400.00020000.00000000.sdmp, tKZVPq.exe, 00000011.00000002.544948329.0000000003401000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000013.00000002.554080549.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000017.00000000.534932278.0000000000402000.00000040.00000400.00020000.00000000.sdmp, tKZVPq.exe, 00000017.00000000.534286456.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: Purchase Order.exe, 00000007.00000002.569789706.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: tKZVPq.exe, 00000011.00000002.541479722.0000000000878000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Users\user\Desktop\Purchase Order.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 7.0.Purchase Order.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 7.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Purchase Order.exe.3fff900.4.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 23.0.tKZVPq.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 7.0.Purchase Order.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 17.2.tKZVPq.exe.35bf900.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 7.0.Purchase Order.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 17.2.tKZVPq.exe.35448e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 23.0.tKZVPq.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 23.2.tKZVPq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 23.0.tKZVPq.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.2.tKZVPq.exe.3bcf900.3.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 17.2.tKZVPq.exe.246817c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.2.Purchase Order.exe.3fff900.4.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Purchase Order.exe.3fff900.4.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 7.0.Purchase Order.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 7.0.Purchase Order.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Purchase Order.exe.3f848e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Purchase Order.exe.3f848e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 23.0.tKZVPq.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 17.2.tKZVPq.exe.35bf900.2.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 23.0.tKZVPq.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.2.tKZVPq.exe.3bcf900.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.2.tKZVPq.exe.3b548e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Purchase Order.exe.2ea8150.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 19.2.tKZVPq.exe.2a7817c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 00000007.00000002.569789706.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: Process Memory Space: Purchase Order.exe PID: 4848, type: MEMORYSTR	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: Process Memory Space: tKZVPq.exe PID: 3732, type: MEMORYSTR	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Purchase Order.exe

.NET source code contains very large array initializations

Source: 7.0.Purchase Order.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007bB747C883u002d44A2u002d40F5u002dB49Bu002dA4294DAD5307u007d/C3D243B9u002d893Du002d4BB7u002d88B3u002dE90A28290F7A.cs	Large array initialization: .cctor: array initializer size 11964
Source: 7.2.Purchase Order.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bB747C883u002d44A2u002d40F5u002dB49Bu002dA4294DAD5307u007d/C3D243B9u002d893Du002d4BB7u002d88B3u002dE90A28290F7A.cs	Large array initialization: .cctor: array initializer size 11964
Source: 7.0.Purchase Order.exe.400000.6.unpack, u003cPrivateImplementationDetailsu003eu007bB747C883u002d44A2u002d40F5u002dB49Bu002dA4294DAD5307u007d/C3D243B9u002d893Du002d4BB7u002d88B3u002dE90A28290F7A.cs	Large array initialization: .cctor: array initializer size 11964
Source: 7.0.Purchase Order.exe.400000.8.unpack, u003cPrivateImplementationDetailsu003eu007bB747C883u002d44A2u002d40F5u002dB49Bu002dA4294DAD5307u007d/C3D243B9u002d893Du002d4BB7u002d88B3u002dE90A28290F7A.cs	Large array initialization: .cctor: array initializer size 11964
Source: 7.0.Purchase Order.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007bB747C883u002d44A2u002d40F5u002dB49Bu002dA4294DAD5307u007d/C3D243B9u002d893Du002d4BB7u002d88B3u002dE90A28290F7A.cs	Large array initialization: .cctor: array initializer size 11964
Source: 7.0.Purchase Order.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007bB747C883u002d44A2u002d40F5u002dB49Bu002dA4294DAD5307u007d/C3D243B9u002d893Du002d4BB7u002d88B3u002dE90A28290F7A.cs	Large array initialization: .cctor: array initializer size 11964

Source: Purchase Order.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 7.0.Purchase Order.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 7.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Purchase Order.exe.3fff900.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 23.0.tKZVPq.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 7.0.Purchase Order.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 17.2.tKZVPq.exe.35bf900.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 7.0.Purchase Order.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 17.2.tKZVPq.exe.35448e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 23.0.tKZVPq.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 23.2.tKZVPq.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 23.0.tKZVPq.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.2.tKZVPq.exe.3bcf900.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 17.2.tKZVPq.exe.246817c.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.2.Purchase Order.exe.3fff900.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Purchase Order.exe.3fff900.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 7.0.Purchase Order.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 7.0.Purchase Order.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Purchase Order.exe.3f848e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Purchase Order.exe.3f848e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 23.0.tKZVPq.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 17.2.tKZVPq.exe.35bf900.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 23.0.tKZVPq.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.2.tKZVPq.exe.3bcf900.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.2.tKZVPq.exe.3b548e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Purchase Order.exe.2ea8150.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 19.2.tKZVPq.exe.2a7817c.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 00000007.00000002.569789706.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: Process Memory Space: Purchase Order.exe PID: 4848, type: MEMORYSTR	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: Process Memory Space: tKZVPq.exe PID: 3732, type: MEMORYSTR	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_0110C827	0_2_0110C827
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_0110C828	0_2_0110C828
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_0110FAB0	0_2_0110FAB0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_0110FAA0	0_2_0110FAA0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_01109D10	0_2_01109D10
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_0110FD8A	0_2_0110FD8A
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_02BB1110	0_2_02BB1110
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_02BB27E8	0_2_02BB27E8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_02BB24F0	0_2_02BB24F0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_02BB6CE8	0_2_02BB6CE8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_02BB72E7	0_2_02BB72E7
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_02BB21E8	0_2_02BB21E8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_02BB1918	0_2_02BB1918
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_02BB1100	0_2_02BB1100
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_02BB27DF	0_2_02BB27DF
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_08E55872	0_2_08E55872
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_08E5D850	0_2_08E5D850
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_08E54DF2	0_2_08E54DF2
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_08E54588	0_2_08E54588
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_08E5DD00	0_2_08E5DD00
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_08E536C8	0_2_08E536C8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_08E567D0	0_2_08E567D0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_08E588E0	0_2_08E588E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_08E588F0	0_2_08E588F0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_08E544DB	0_2_08E544DB
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_08E56C80	0_2_08E56C80
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 7_2_011D47A0	7_2_011D47A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 7_2_011D3CCC	7_2_011D3CCC
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 7_2_011D4790	7_2_011D4790
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 7_2_011D5490	7_2_011D5490
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 7_2_011DD820	7_2_011DD820
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_00A7C828	17_2_00A7C828
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_00A7FAA0	17_2_00A7FAA0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_00A7FAB0	17_2_00A7FAB0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_00A79D10	17_2_00A79D10
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_02266B48	17_2_02266B48
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_02261080	17_2_02261080
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_02262758	17_2_02262758
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_02266B3A	17_2_02266B3A
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_02261070	17_2_02261070
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_02261879	17_2_02261879
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_02261888	17_2_02261888
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_02267148	17_2_02267148
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_02262159	17_2_02262159
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_02262748	17_2_02262748
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07F5C588	17_2_07F5C588
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07F57B90	17_2_07F57B90
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07F5BAB0	17_2_07F5BAB0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07F588E0	17_2_07F588E0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07F52690	17_2_07F52690
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07F55568	17_2_07F55568
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07F55558	17_2_07F55558
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07F54CB8	17_2_07F54CB8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07F54CA8	17_2_07F54CA8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07F54B48	17_2_07F54B48
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07F54B38	17_2_07F54B38
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07F559F8	17_2_07F559F8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07F559E8	17_2_07F559E8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA67D0	17_2_07FA67D0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA36C8	17_2_07FA36C8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA4DE8	17_2_07FA4DE8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA4588	17_2_07FA4588
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FADD00	17_2_07FADD00
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA5872	17_2_07FA5872
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FAD850	17_2_07FAD850
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA678B	17_2_07FA678B
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA8F78	17_2_07FA8F78
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA8B48	17_2_07FA8B48
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA8B38	17_2_07FA8B38
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA7727	17_2_07FA7727
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA7718	17_2_07FA7718
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA7708	17_2_07FA7708
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA6709	17_2_07FA6709
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA9A6D	17_2_07FA9A6D
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA8DC0	17_2_07FA8DC0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA8DB0	17_2_07FA8DB0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA3968	17_2_07FA3968
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA88F0	17_2_07FA88F0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA88E0	17_2_07FA88E0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA44DD	17_2_07FA44DD
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA6C80	17_2_07FA6C80
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_00E7C5D0	19_2_00E7C5D0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_00E7FAA0	19_2_00E7FAA0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_00E7FAB0	19_2_00E7FAB0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_00E7FD8A	19_2_00E7FD8A
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_00E79D10	19_2_00E79D10
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_04A32460	19_2_04A32460
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_04A32758	19_2_04A32758
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_04A31080	19_2_04A31080
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_04A32748	19_2_04A32748
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_04A32159	19_2_04A32159
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_04A30D30	19_2_04A30D30
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_04A31888	19_2_04A31888
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_04A31879	19_2_04A31879
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_04A33B57	19_2_04A33B57
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_0843D850	19_2_0843D850
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_08435872	19_2_08435872
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_0843DD00	19_2_0843DD00
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_08434DE8	19_2_08434DE8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_08434588	19_2_08434588
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_084336C8	19_2_084336C8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_084367D0	19_2_084367D0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_084388E0	19_2_084388E0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_084388F0	19_2_084388F0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_08433968	19_2_08433968
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_08439A18	19_2_08439A18
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_08438B48	19_2_08438B48
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_08438B38	19_2_08438B38
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_084344D8	19_2_084344D8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_08436C80	19_2_08436C80
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_08438DC0	19_2_08438DC0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_08438DB0	19_2_08438DB0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_084366D0	19_2_084366D0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_084376D0	19_2_084376D0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_084376D8	19_2_084376D8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_08438F78	19_2_08438F78
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_08437708	19_2_08437708
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_08437718	19_2_08437718
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 23_2_00F347A0	23_2_00F347A0
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 23_2_00F346B0	23_2_00F346B0

Source: C:\Users\user\Desktop\Purchase Order.exe

Process Stats: CPU usage > 98%

Source: Purchase Order.exe, 00000000.00000002.383123542.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs Purchase Order.exe
Source: Purchase Order.exe, 00000000.00000002.383123542.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameaNWASxaOLUDUuWfyRdPyaxGxcwltyjgGnzufI.exe4 vs Purchase Order.exe
Source: Purchase Order.exe, 00000000.00000002.383066984.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Purchase Order.exe
Source: Purchase Order.exe, 00000000.00000002.383716260.0000000003236000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Purchase Order.exe
Source: Purchase Order.exe, 00000000.00000002.382135462.00000000009E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamekAj5Hnj.exe> vs Purchase Order.exe
Source: Purchase Order.exe, 00000000.00000002.384446432.0000000003E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Purchase Order.exe
Source: Purchase Order.exe, 00000000.00000002.384446432.0000000003E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameaNWASxaOLUDUuWfyRdPyaxGxcwltyjgGnzufI.exe4 vs Purchase Order.exe
Source: Purchase Order.exe, 00000000.00000002.389151124.0000000009170000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Purchase Order.exe
Source: Purchase Order.exe, 00000000.00000002.386598355.00000000040FB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekAj5Hnj.exe> vs Purchase Order.exe
Source: Purchase Order.exe, 00000006.00000000.372788358.0000000000342000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamekAj5Hnj.exe> vs Purchase Order.exe
Source: Purchase Order.exe, 00000007.00000000.376065987.0000000000802000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamekAj5Hnj.exe> vs Purchase Order.exe
Source: Purchase Order.exe, 00000007.00000000.377300432.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameaNWASxaOLUDUuWfyRdPyaxGxcwltyjgGnzufI.exe4 vs Purchase Order.exe
Source: Purchase Order.exe, 00000007.00000003.450912799.0000000006396000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekAj5Hnj.exe> vs Purchase Order.exe
Source: Purchase Order.exe	Binary or memory string: OriginalFilenamekAj5Hnj.exe> vs Purchase Order.exe

Source: Purchase Order.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: TRaCepbEuy.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tKZVPq.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Purchase Order.exe	Virustotal: Detection: 39%
Source: Purchase Order.exe	ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\Purchase Order.exe

File read: C:\Users\user\Desktop\Purchase Order.exe

Jump to behavior

Source: Purchase Order.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Purchase Order.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Purchase Order.exe "C:\Users\user\Desktop\Purchase Order.exe"
Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmp8E57.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Users\user\Desktop\Purchase Order.exe {path}
Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Users\user\Desktop\Purchase Order.exe {path}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe "C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe "C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe"
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmpACD7.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe {path}
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmpD0CA.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe {path}
Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmp8E57.tmp	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Users\user\Desktop\Purchase Order.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Users\user\Desktop\Purchase Order.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmpACD7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmpD0CA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\Purchase Order.exe

File created: C:\Users\user\AppData\Roaming\TRaCepbEuy.exe

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

File created: C:\Users\user\AppData\Local\Temp\tmp8E57.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.adwa.evad.winEXE@20/9@0/0

Source: C:\Users\user\Desktop\Purchase Order.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6576:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4936:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2532:120:WilError_01

Source: 7.0.Purchase Order.exe.400000.10.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.0.Purchase Order.exe.400000.10.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.2.Purchase Order.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.2.Purchase Order.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.0.Purchase Order.exe.400000.6.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.0.Purchase Order.exe.400000.6.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Purchase Order.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Purchase Order.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Purchase Order.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_009156A1 pushad ; iretd	0_2_009156C8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_00914DD9 push esp; ret	0_2_00914DDD
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_011042CB push edi; ret	0_2_011042E2
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_011054E9 push esi; ret	0_2_011054EE
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 6_2_002756A1 pushad ; iretd	6_2_002756C8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 6_2_00274DD9 push esp; ret	6_2_00274DDD
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 7_2_00734DD9 push esp; ret	7_2_00734DDD
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 7_2_007356A1 pushad ; iretd	7_2_007356C8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_000156A1 pushad ; iretd	17_2_000156C8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_00014DD9 push esp; ret	17_2_00014DDD
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 17_2_07FA9D25 push es; retf	17_2_07FA9D28
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_005E4DD9 push esp; ret	19_2_005E4DDD
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_005E56A1 pushad ; iretd	19_2_005E56C8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 19_2_08439D25 push es; retf	19_2_08439D28
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 23_2_00F3CF71 push esp; iretd	23_2_00F3CF7D
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 28_2_009F56A1 pushad ; iretd	28_2_009F56C8
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Code function: 28_2_009F4DD9 push esp; ret	28_2_009F4DDD

Source: initial sample	Static PE information: section name: .text entropy: 7.31350730909
Source: initial sample	Static PE information: section name: .text entropy: 7.31350730909
Source: initial sample	Static PE information: section name: .text entropy: 7.31350730909

Source: C:\Users\user\Desktop\Purchase Order.exe	File created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Purchase Order.exe	File created: C:\Users\user\AppData\Roaming\TRaCepbEuy.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Purchase Order.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmp8E57.tmp

Source: C:\Users\user\Desktop\Purchase Order.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run tKZVPq			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run tKZVPq			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Purchase Order.exe

File opened: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Purchase Order.exe PID: 4872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 5416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 3416, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Purchase Order.exe, 00000000.00000002.383123542.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000011.00000002.542476618.000000000243B000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000013.00000002.552617624.0000000002A4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Purchase Order.exe, 00000000.00000002.383123542.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000011.00000002.542476618.000000000243B000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000013.00000002.552617624.0000000002A4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Purchase Order.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Purchase Order.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Purchase Order.exe TID: 5912	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 4480	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 3192	Thread sleep count: 3025 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 3192	Thread sleep count: 6830 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe TID: 4324	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Window / User API: threadDelayed 3025			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Window / User API: threadDelayed 6830			Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\Purchase Order.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: tKZVPq.exe, 00000013.00000002.551783085.0000000000EB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:
Source: tKZVPq.exe, 00000013.00000002.552617624.0000000002A4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: tKZVPq.exe, 00000013.00000002.552617624.0000000002A4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: tKZVPq.exe, 00000013.00000002.552617624.0000000002A4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: tKZVPq.exe, 00000013.00000002.552617624.0000000002A4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: tKZVPq.exe, 00000013.00000002.552617624.0000000002A4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: tKZVPq.exe, 00000013.00000002.552617624.0000000002A4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: tKZVPq.exe, 00000013.00000002.552617624.0000000002A4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: tKZVPq.exe, 00000013.00000002.552617624.0000000002A4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: tKZVPq.exe, 00000013.00000002.552617624.0000000002A4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\Purchase Order.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Modifies the hosts file

Source: C:\Users\user\Desktop\Purchase Order.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Purchase Order.exe	Memory written: C:\Users\user\Desktop\Purchase Order.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Memory written: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmp8E57.tmp	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Users\user\Desktop\Purchase Order.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Users\user\Desktop\Purchase Order.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmpACD7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmpD0CA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Process created: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Users\user\Desktop\Purchase Order.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Users\user\Desktop\Purchase Order.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\Desktop\Purchase Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Users\user\Desktop\Purchase Order.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 7.0.Purchase Order.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.3fff900.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.tKZVPq.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Purchase Order.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.tKZVPq.exe.35bf900.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Purchase Order.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.tKZVPq.exe.35448e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.tKZVPq.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.tKZVPq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.tKZVPq.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.tKZVPq.exe.3bcf900.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.3fff900.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Purchase Order.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Purchase Order.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.3f848e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.tKZVPq.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.tKZVPq.exe.35bf900.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.tKZVPq.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.tKZVPq.exe.3bcf900.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.tKZVPq.exe.3b548e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000000.377300432.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.376818442.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.378482840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.534932278.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.554080549.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.377959898.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.535514668.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.534286456.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.566073924.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.386598355.00000000040FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.536182206.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.384446432.0000000003E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.567278813.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.544948329.0000000003401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.569789706.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Order.exe PID: 4872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Purchase Order.exe PID: 4848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 5416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 3416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 3732, type: MEMORYSTR

Source: Yara match	File source: 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.569789706.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Order.exe PID: 4848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 3732, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 7.0.Purchase Order.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.3fff900.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.tKZVPq.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Purchase Order.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.tKZVPq.exe.35bf900.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Purchase Order.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.tKZVPq.exe.35448e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.tKZVPq.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.tKZVPq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.tKZVPq.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.tKZVPq.exe.3bcf900.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.3fff900.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Purchase Order.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Purchase Order.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.3f848e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.tKZVPq.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.tKZVPq.exe.35bf900.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.tKZVPq.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.tKZVPq.exe.3bcf900.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.tKZVPq.exe.3b548e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000000.377300432.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.376818442.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.378482840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.534932278.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.554080549.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.377959898.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.535514668.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.534286456.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.566073924.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.386598355.00000000040FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.536182206.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.384446432.0000000003E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.567278813.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.544948329.0000000003401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.569789706.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Order.exe PID: 4872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Purchase Order.exe PID: 4848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 5416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 3416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tKZVPq.exe PID: 3732, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	1 Masquerading	1 Input Capture	311 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 File and Directory Permissions Modification	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	131 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	111 Process Injection	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Obfuscated Files or Information	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	2 Software Packing	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Purchase Order.exe	40%	Virustotal		Browse
Purchase Order.exe	50%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
Purchase Order.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\TRaCepbEuy.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\TRaCepbEuy.exe	40%	Virustotal		Browse
C:\Users\user\AppData\Roaming\TRaCepbEuy.exe	50%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	40%	Virustotal		Browse
C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe	50%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Download
7.0.Purchase Order.exe.400000.10.unpack	100%	Avira	TR/Spy.Gen8	Download File
23.2.tKZVPq.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
7.2.Purchase Order.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
23.0.tKZVPq.exe.400000.12.unpack	100%	Avira	TR/Spy.Gen8	Download File
7.0.Purchase Order.exe.400000.6.unpack	100%	Avira	TR/Spy.Gen8	Download File
7.0.Purchase Order.exe.400000.8.unpack	100%	Avira	TR/Spy.Gen8	Download File
23.0.tKZVPq.exe.400000.10.unpack	100%	Avira	TR/Spy.Gen8	Download File
23.0.tKZVPq.exe.400000.6.unpack	100%	Avira	TR/Spy.Gen8	Download File
7.0.Purchase Order.exe.400000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File
7.0.Purchase Order.exe.400000.12.unpack	100%	Avira	TR/Spy.Gen8	Download File
23.0.tKZVPq.exe.400000.8.unpack	100%	Avira	TR/Spy.Gen8	Download File
23.0.tKZVPq.exe.400000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://ybzARF.com	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	Purchase Order.exe, 00000007.00000002.569789706.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false		high
http://DynDns.comDynDNS	tKZVPq.exe, 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	Purchase Order.exe, 00000007.00000002.569789706.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ybzARF.com	tKZVPq.exe, 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Purchase Order.exe, 00000000.00000002.383066984.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000011.00000002.542437762.0000000002401000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000013.00000002.552495218.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Purchase Order.exe, 00000000.00000002.388094306.0000000007012000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	Purchase Order.exe, 00000000.00000002.384446432.0000000003E41000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000000.00000002.386598355.00000000040FB000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000007.00000000.377300432.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Purchase Order.exe, 00000007.00000000.376818442.0000000000402000.00000040.00000400.00020000.00000000.sdmp, tKZVPq.exe, 00000011.00000002.544948329.0000000003401000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000013.00000002.554080549.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, tKZVPq.exe, 00000017.00000000.534932278.0000000000402000.00000040.00000400.00020000.00000000.sdmp, tKZVPq.exe, 00000017.00000000.534286456.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	562512
Start date:	28.01.2022
Start time:	23:35:03
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Purchase Order.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.adwa.evad.winEXE@20/9@0/0
EGA Information:	Successful, ratio: 71.4%
HDC Information:	Successful, ratio: 2.3% (good quality ratio 1%) Quality average: 33.8% Quality standard deviation: 40.2%
HCA Information:	Successful, ratio: 95% Number of executed functions: 140 Number of non-executed functions: 17
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, fs.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Execution Graph export aborted for target Purchase Order.exe, PID 1880 because there are no executed function
Execution Graph export aborted for target tKZVPq.exe, PID 6856 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:36:30	API Interceptor	439x Sleep call for process: Purchase Order.exe modified
23:37:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run tKZVPq C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
23:37:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run tKZVPq C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
23:37:42	API Interceptor	2x Sleep call for process: tKZVPq.exe modified

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tKZVPq.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Temp\tmp8E57.tmp

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1643
Entropy (8bit):	5.185357543359401
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBjtn:cbh47TlNQ//rydbz9I3YODOLNdq3H
MD5:	2910C09B515C12498D48A2CEB8B2E2D4
SHA1:	B806BD7B3477B112B649CC4054FC96CAF6B7FCA7
SHA-256:	A4BEABC21D8F857F4E4AC50D6F599D1B8023172BC6E51967516F1BEB068DD819
SHA-512:	2AB2812469BE0E51B3760950019017AE37C63BADD2277FE1E41BDBD64FDA34506D43B68479F75A4C50062D685BAC993C4926F47DAB35C02676FDF435715A42E1
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Local\Temp\tmpACD7.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1643
Entropy (8bit):	5.185357543359401
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBjtn:cbh47TlNQ//rydbz9I3YODOLNdq3H
MD5:	2910C09B515C12498D48A2CEB8B2E2D4
SHA1:	B806BD7B3477B112B649CC4054FC96CAF6B7FCA7
SHA-256:	A4BEABC21D8F857F4E4AC50D6F599D1B8023172BC6E51967516F1BEB068DD819
SHA-512:	2AB2812469BE0E51B3760950019017AE37C63BADD2277FE1E41BDBD64FDA34506D43B68479F75A4C50062D685BAC993C4926F47DAB35C02676FDF435715A42E1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Local\Temp\tmpD0CA.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1643
Entropy (8bit):	5.185357543359401
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBjtn:cbh47TlNQ//rydbz9I3YODOLNdq3H
MD5:	2910C09B515C12498D48A2CEB8B2E2D4
SHA1:	B806BD7B3477B112B649CC4054FC96CAF6B7FCA7
SHA-256:	A4BEABC21D8F857F4E4AC50D6F599D1B8023172BC6E51967516F1BEB068DD819
SHA-512:	2AB2812469BE0E51B3760950019017AE37C63BADD2277FE1E41BDBD64FDA34506D43B68479F75A4C50062D685BAC993C4926F47DAB35C02676FDF435715A42E1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Roaming\TRaCepbEuy.exe

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	909312
Entropy (8bit):	7.201647564710609
Encrypted:	false
SSDEEP:	12288:djtXf+RPhTN0zwBGc5kS+/WW7kY3zkjqnP5QaMZk+JOi6ZRWifvsKE5U9PH+me0Y:PmV9NE7Sl++WIvsjA+2VYJUEKlCW
MD5:	13D83A3812EC316654034E15F506AA06
SHA1:	9D4F2AFE54CA9B3CD31912B10DCC288B6696F3EA
SHA-256:	2518A50E9483DA255CB061CB5EB966F41F39DAF912341E7CF4442DA4B362DA8C
SHA-512:	7D17B219311E86C4F32726AEF5839212EE125C7E3A3A3A97D5719C0A51DDF09FCE543F3B5BFFD8577944B916C9635BC1E68D604B381F20504B5E421B591E3BA5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 40%, Browse Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a..............P......J........... ........@.. .......................@............@.................................T...W........F................... ....................................................... ............... ..H............text........ ...................... ..`.rsrc....F.......H..................@..@.reloc....... ......................@..B........................H............)..........p2...V...........................................0..............0............ ..e. .D..a%..^E........+...........+)("...(..... A..>Z .gewa+... P...Z ....a+......(.....(.... .7. .D..a%..^E................+... :,.<Z ...9a+.........RS.......0............(#......($......(%......(.......(&.......0..D.........(....o....('... 0..F ...+a%..^E................+... ..l.Z .Kj.a+..0...........((.....0............o)....0............(...*.0............(+....

C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	909312
Entropy (8bit):	7.201647564710609
Encrypted:	false
SSDEEP:	12288:djtXf+RPhTN0zwBGc5kS+/WW7kY3zkjqnP5QaMZk+JOi6ZRWifvsKE5U9PH+me0Y:PmV9NE7Sl++WIvsjA+2VYJUEKlCW
MD5:	13D83A3812EC316654034E15F506AA06
SHA1:	9D4F2AFE54CA9B3CD31912B10DCC288B6696F3EA
SHA-256:	2518A50E9483DA255CB061CB5EB966F41F39DAF912341E7CF4442DA4B362DA8C
SHA-512:	7D17B219311E86C4F32726AEF5839212EE125C7E3A3A3A97D5719C0A51DDF09FCE543F3B5BFFD8577944B916C9635BC1E68D604B381F20504B5E421B591E3BA5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 40%, Browse Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a..............P......J........... ........@.. .......................@............@.................................T...W........F................... ....................................................... ............... ..H............text........ ...................... ..`.rsrc....F.......H..................@..@.reloc....... ......................@..B........................H............)..........p2...V...........................................0..............0............ ..e. .D..a%..^E........+...........+)("...(..... A..>Z .gewa+... P...Z ....a+......(.....(.... .7. .D..a%..^E................+... :,.<Z ...9a+.........RS.......0............(#......($......(%......(.......(&.......0..D.........(....o....('... 0..F ...+a%..^E................+... ..l.Z .Kj.a+..0...........((.....0............o)....0............(...*.0............(+....

C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	835
Entropy (8bit):	4.694294591169137
Encrypted:	false
SSDEEP:	24:QWDZh+ragzMZfuMMs1L/JU5fFCkK8T1rTt8:vDZhyoZWM9rU5fFcP
MD5:	6EB47C1CF858E25486E42440074917F2
SHA1:	6A63F93A95E1AE831C393A97158C526A4FA0FAAE
SHA-256:	9B13A3EA948A1071A81787AAC1930B89E30DF22CE13F8FF751F31B5D83E79FFB
SHA-512:	08437AB32E7E905EB11335E670CDD5D999803390710ED39CBC31A2D3F05868D5D0E5D051CCD7B06A85BB466932F99A220463D27FAC29116D241E8ADAC495FA2F
Malicious:	true
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....127.0.0.1

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.201647564710609
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Purchase Order.exe
File size:	909312
MD5:	13d83a3812ec316654034e15f506aa06
SHA1:	9d4f2afe54ca9b3cd31912b10dcc288b6696f3ea
SHA256:	2518a50e9483da255cb061cb5eb966f41f39daf912341e7cf4442da4b362da8c
SHA512:	7d17b219311e86c4f32726aef5839212ee125c7e3a3a3a97d5719c0a51ddf09fce543f3b5bffd8577944b916c9635bc1e68d604b381f20504b5e421b591e3ba5
SSDEEP:	12288:djtXf+RPhTN0zwBGc5kS+/WW7kY3zkjqnP5QaMZk+JOi6ZRWifvsKE5U9PH+me0Y:PmV9NE7Sl++WIvsjA+2VYJUEKlCW
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a..............P......J........... ........@.. .......................@............@................................

File Icon


Icon Hash:	04fcf0b0d4a6e46c

Static PE Info

General

Entrypoint:	0x4ab2ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61F3EF1B [Fri Jan 28 13:26:51 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xab254	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xac000	0x34698	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa92b4	0xa9400	False	0.683070127862	data	7.31350730909	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xac000	0x34698	0x34800	False	0.444480096726	data	6.25657435947	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe2000	0xc	0x200	False	0.044921875	data	0.0980041756627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xac2b0	0xc5d8	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0xb8888	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
RT_ICON	0xc90b0	0x94a8	data
RT_ICON	0xd2558	0x5488	data
RT_ICON	0xd79e0	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4294967295, next used block 4294967295
RT_ICON	0xdbc08	0x25a8	data
RT_ICON	0xde1b0	0x10a8	data
RT_ICON	0xdf258	0x988	data
RT_ICON	0xdfbe0	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xe0048	0x84	data
RT_VERSION	0xe00cc	0x3dc	data
RT_MANIFEST	0xe04a8	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2009-2021 Alexey Nicolaychuk aka Unwinder, developed special for Micro-Star Intl Co., Ltd.
Assembly Version	1.0.0.0
InternalName	kAj5Hnj.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	MSIAfterburner
ProductVersion	1.0.0.0
FileDescription	MSIAfterburner
OriginalFilename	kAj5Hnj.exe

Target ID:	0
Start time:	23:36:02
Start date:	28/01/2022
Path:	C:\Users\user\Desktop\Purchase Order.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Purchase Order.exe"
Imagebase:	0x910000
File size:	909312 bytes
MD5 hash:	13D83A3812EC316654034E15F506AA06
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.386598355.00000000040FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.386598355.00000000040FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.384446432.0000000003E41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.384446432.0000000003E41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	4
Start time:	23:36:34
Start date:	28/01/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmp8E57.tmp
Imagebase:	0x11c0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	23:36:36
Start date:	28/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	23:36:37
Start date:	28/01/2022
Path:	C:\Users\user\Desktop\Purchase Order.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x270000
File size:	909312 bytes
MD5 hash:	13D83A3812EC316654034E15F506AA06
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	7
Start time:	23:36:39
Start date:	28/01/2022
Path:	C:\Users\user\Desktop\Purchase Order.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x730000
File size:	909312 bytes
MD5 hash:	13D83A3812EC316654034E15F506AA06
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000000.377300432.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000007.00000000.377300432.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000000.376818442.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000007.00000000.376818442.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000000.378482840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000007.00000000.378482840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000000.377959898.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000007.00000000.377959898.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.566073924.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000007.00000002.566073924.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.569789706.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.569789706.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AgentTeslaV3, Description: AgentTeslaV3 infostealer payload, Source: 00000007.00000002.569789706.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low

Show Windows behavior

Target ID:	17
Start time:	23:37:25
Start date:	28/01/2022
Path:	C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe"
Imagebase:	0x10000
File size:	909312 bytes
MD5 hash:	13D83A3812EC316654034E15F506AA06
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000002.544948329.0000000003401000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000011.00000002.544948329.0000000003401000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 40%, Virustotal, Browse Detection: 50%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	19
Start time:	23:37:34
Start date:	28/01/2022
Path:	C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe"
Imagebase:	0x5e0000
File size:	909312 bytes
MD5 hash:	13D83A3812EC316654034E15F506AA06
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.554080549.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000013.00000002.554080549.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	21
Start time:	23:37:48
Start date:	28/01/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmpACD7.tmp
Imagebase:	0x11c0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	22
Start time:	23:37:52
Start date:	28/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	23
Start time:	23:37:52
Start date:	28/01/2022
Path:	C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x730000
File size:	909312 bytes
MD5 hash:	13D83A3812EC316654034E15F506AA06
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AgentTeslaV3, Description: AgentTeslaV3 infostealer payload, Source: 00000017.00000002.569618047.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000017.00000000.534932278.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000017.00000000.534932278.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000017.00000000.535514668.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000017.00000000.535514668.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000017.00000000.534286456.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000017.00000000.534286456.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000017.00000000.536182206.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000017.00000000.536182206.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000017.00000002.567278813.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000017.00000002.567278813.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	25
Start time:	23:37:58
Start date:	28/01/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRaCepbEuy" /XML "C:\Users\user\AppData\Local\Temp\tmpD0CA.tmp
Imagebase:	0x11c0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	26
Start time:	23:37:59
Start date:	28/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	28
Start time:	23:38:00
Start date:	28/01/2022
Path:	C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x7ff70d6e0000
File size:	909312 bytes
MD5 hash:	13D83A3812EC316654034E15F506AA06
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5%
Total number of Nodes:	199
Total number of Limit Nodes:	23

Executed Functions

Function 08E567D0 Relevance: 2.8, Strings: 2, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fg<Y, xrefs: 08E56956
_{D@, xrefs: 08E56B94

Memory Dump Source

Source File: 00000000.00000002.389105149.0000000008E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e50000_Purchase Order.jbxd

Similarity

API ID:
String ID: _{D@$fg<Y
API String ID: 0-51650776
Opcode ID: e821f235ce97d6afb9e13130fba16d1be510209772ed6b54dcedeb9caef9a3e7
Instruction ID: 635132460b52ed2e80164b18c4aa378a5da87a710e00863dfe5c8f14ab5304c9
Opcode Fuzzy Hash: e821f235ce97d6afb9e13130fba16d1be510209772ed6b54dcedeb9caef9a3e7
Instruction Fuzzy Hash: C8D15CB1D0520ADFCB44CFA5C5858AEFBB2FF99302B54E559C815AB224D734EA42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 08E5DD00 Relevance: 1.6, Strings: 1, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D0bm, xrefs: 08E5DE53

Memory Dump Source

Source File: 00000000.00000002.389105149.0000000008E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e50000_Purchase Order.jbxd

Similarity

API ID:
String ID: D0bm
API String ID: 0-1972494630
Opcode ID: bfcbc990b189511c07b5a52e504092f9152bac74896199cfe0f34705a69452d0
Instruction ID: fce4c8a6ea6987103fe2e93cc228108fe45736f86d912d166e6b5b34e9890277
Opcode Fuzzy Hash: bfcbc990b189511c07b5a52e504092f9152bac74896199cfe0f34705a69452d0
Instruction Fuzzy Hash: FED1B275F0520A8FCB04DFF9C9456EEBBF6AFC8315F109829D805A7354DB349A018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 08E544DB Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

D^, xrefs: 08E54616

Memory Dump Source

Source File: 00000000.00000002.389105149.0000000008E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e50000_Purchase Order.jbxd

Similarity

API ID:
String ID: D^
API String ID: 0-2137943434
Opcode ID: 46674d338ad97e8b2994b4c09cee20103d4df28af53685ece58a81773384dd1e
Instruction ID: be73c059f9225bf331daa2ef45137598cddf6dff63032299951a2302c701d1c8
Opcode Fuzzy Hash: 46674d338ad97e8b2994b4c09cee20103d4df28af53685ece58a81773384dd1e
Instruction Fuzzy Hash: 34B157B5E04219CFCB04CFA9C8846EEBBB2FF89305F20942AD915EB254D7349942CF65

Uniqueness

Uniqueness Score: -1.00%

Function 08E54588 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

D^, xrefs: 08E54616

Memory Dump Source

Source File: 00000000.00000002.389105149.0000000008E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e50000_Purchase Order.jbxd

Similarity

API ID:
String ID: D^
API String ID: 0-2137943434
Opcode ID: 8b4b68e2b4fb60060405b2599c3486e709e3fc262a4ca3cb081a36e561c3329a
Instruction ID: fc0c629244e1add84bf60e7b7d9305a688a21e6ddcf2a578e39f294a6d2d5403
Opcode Fuzzy Hash: 8b4b68e2b4fb60060405b2599c3486e709e3fc262a4ca3cb081a36e561c3329a
Instruction Fuzzy Hash: 8D81C2B5E002188FCB08CFE9C984ADEBBB2FF89305F10942AD919BB254D7709946CF55

Uniqueness

Uniqueness Score: -1.00%

Function 02BB24F0 Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

?p`(, xrefs: 02BB2688

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID:
String ID: ?p`(
API String ID: 0-2377489638
Opcode ID: 88f6c19529874f9f0cfccd70ed72fa88c2dbde7578d868e14f290307c8b1b4a9
Instruction ID: 154b2219e95b24860fd1f1f48447ae9b309a469610258cfa44404b2074a9ddda
Opcode Fuzzy Hash: 88f6c19529874f9f0cfccd70ed72fa88c2dbde7578d868e14f290307c8b1b4a9
Instruction Fuzzy Hash: D3714B74D1A208DBCB06CFA5D6906EDFBB6FF89300F24A46AD406A7254D7B48945CB04

Uniqueness

Uniqueness Score: -1.00%

Function 08E5D850 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389105149.0000000008E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e50000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea3f0c88621e663c9759ff5332fa10ddf2070ed3e352147c024ad5d93e1ebc9
Instruction ID: 38e9bfb1c2217012e33288408c6832691111efc5b2f40a498f18294895acb3bc
Opcode Fuzzy Hash: 7ea3f0c88621e663c9759ff5332fa10ddf2070ed3e352147c024ad5d93e1ebc9
Instruction Fuzzy Hash: C1A11275E052198BDB04DFE9C9446DEFBF2AF88311F24D529D808AB318E7349942CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08E536C8 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389105149.0000000008E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e50000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08f8e513e1b44883db4b6deea0a0424f8121b34a5f95c815186109f96d7fbfa
Instruction ID: 1800cdc1c2d7c79f7206ddd92a343df0600e688c9d57913cfdf1284517243da2
Opcode Fuzzy Hash: b08f8e513e1b44883db4b6deea0a0424f8121b34a5f95c815186109f96d7fbfa
Instruction Fuzzy Hash: B381E476E00215DFC71DCFA9C184AAABBB2AF82346B25D56DCC055B395C731EC42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BB1100 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940e92d90d59b591990003b3401cc7a7e4c9657ba37a4f31e6b1b1dd98383bc9
Instruction ID: b23ad20f893d272bcba34397b609bc75795cf95c19dbe6cb216819f26a65367f
Opcode Fuzzy Hash: 940e92d90d59b591990003b3401cc7a7e4c9657ba37a4f31e6b1b1dd98383bc9
Instruction Fuzzy Hash: DD8114B4E002599FCB04DFE5D8555EEBBB2FF89300F20946AD81AAB368DB745942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02BB1110 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75abc7be07f1e7d3291ed7fb82d5ac12f7748b5da6c0556bbf1dcb0419e1b254
Instruction ID: 47bc83ea9a619d2139a2dd0254b4ca9ffbd7d820f092f5aa5be3f6bdbfa3e17f
Opcode Fuzzy Hash: 75abc7be07f1e7d3291ed7fb82d5ac12f7748b5da6c0556bbf1dcb0419e1b254
Instruction Fuzzy Hash: 9D81F3B4E102199FCB04DFE5D8555EEBBB2FF89300F209529D81AAB368DB745941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 08E54DF2 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389105149.0000000008E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e50000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffab54983296478ddded8adbd5d9ff5b7c542c1316b8f17f174f965bfeb87af0
Instruction ID: 1920286a78348b5bf9b25a1a1b03befc53502931dfa31a1aafaa7a45f6b9b444
Opcode Fuzzy Hash: ffab54983296478ddded8adbd5d9ff5b7c542c1316b8f17f174f965bfeb87af0
Instruction Fuzzy Hash: BE512CB5E05209CFDB08CFAAD5415EEFBF2AF89305F14D02AD915BB294D7348A818F58

Uniqueness

Uniqueness Score: -1.00%

Function 02BB27E8 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3889ab31c1be23206d8ba6bc4564fbe814056cc6457be24eb924ff804151c051
Instruction ID: 893536270011096283392be771ab80532900723c7f9ee1d5d59520a777646c7d
Opcode Fuzzy Hash: 3889ab31c1be23206d8ba6bc4564fbe814056cc6457be24eb924ff804151c051
Instruction Fuzzy Hash: AA511971E5462A8BDB24CF65CD447E9BBB6EF99300F1082EAD50DA7254EBB05AC48F40

Uniqueness

Uniqueness Score: -1.00%

Function 02BB6CE8 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3904c999e9d8ba70e5e36ed4797f4466c90bcc73c2a2151da6d059d63c4eefe7
Instruction ID: 5ab59548ba40593c47b9b39a2c254745040f4c1d7de7e843e4712013433a9f5b
Opcode Fuzzy Hash: 3904c999e9d8ba70e5e36ed4797f4466c90bcc73c2a2151da6d059d63c4eefe7
Instruction Fuzzy Hash: 6D415874E15218DBCB05CFA6D5847EEFBB6EF89200F14A56AE001B7294D7B49900CF24

Uniqueness

Uniqueness Score: -1.00%

Function 02BB27DF Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bede4d2a69d8bf624c9eb91d0b6b66724a5536542feaa3262c863b2fe02e3b
Instruction ID: d4a1fd855bb41c9b2b787a76468a1aa42e0775aa5434890dbb9f2e29d6d35b5a
Opcode Fuzzy Hash: b2bede4d2a69d8bf624c9eb91d0b6b66724a5536542feaa3262c863b2fe02e3b
Instruction Fuzzy Hash: BE511A71E5062A8BDB28CF65CD447E9BBB2BFC8300F1082EAD508A7654EB705AC58F40

Uniqueness

Uniqueness Score: -1.00%

Function 08E55872 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389105149.0000000008E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e50000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6e27349b67761e06cf592bfcc41418568c16d47eca0fe885dc15172748f056
Instruction ID: c291af433290532b45aae5041efae6f53dd45102a3744e6cab1e0af8b6013d31
Opcode Fuzzy Hash: 2d6e27349b67761e06cf592bfcc41418568c16d47eca0fe885dc15172748f056
Instruction Fuzzy Hash: 132119B1E006588BEB18CFA7D8443CEBBB6AFC9311F14C17AD818A6264DB755945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01106EA0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01106F10
GetCurrentThread.KERNEL32 ref: 01106F4D
GetCurrentProcess.KERNEL32 ref: 01106F8A
GetCurrentThreadId.KERNEL32 ref: 01106FE3

Strings

ho, xrefs: 0110700F

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID: Current$ProcessThread
String ID: ho
API String ID: 2063062207-2014758431
Opcode ID: 9646a03b9dc854c99d79701bd27d2b133384b9c7114b49ebf7485a9899355fbc
Instruction ID: c33530ce97b69297d4dbd311bfc45149f399b2dac795b72a1fac4f2047853618
Opcode Fuzzy Hash: 9646a03b9dc854c99d79701bd27d2b133384b9c7114b49ebf7485a9899355fbc
Instruction Fuzzy Hash: D25133B4D00249CFDB19CFA9D648BDEBBF0BF88304F248959E059A7290D7749848CF66

Uniqueness

Uniqueness Score: -1.00%

Function 01106EB0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01106F10
GetCurrentThread.KERNEL32 ref: 01106F4D
GetCurrentProcess.KERNEL32 ref: 01106F8A
GetCurrentThreadId.KERNEL32 ref: 01106FE3

Strings

ho, xrefs: 0110700F

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID: Current$ProcessThread
String ID: ho
API String ID: 2063062207-2014758431
Opcode ID: 63abeceacd9aa61f44d760f14ce5f927807a703ede55e3a1f8104c09d5332dfc
Instruction ID: 9faa98c4e7e602e9ce7ab2173407c273b096b5d23120ad696bdf772d2a814460
Opcode Fuzzy Hash: 63abeceacd9aa61f44d760f14ce5f927807a703ede55e3a1f8104c09d5332dfc
Instruction Fuzzy Hash: D15143B4D00249CFDB19CFAAD648BDEBBF4AF88304F24895DE019A7290D7746844CF66

Uniqueness

Uniqueness Score: -1.00%

Function 02BB4253 Relevance: 3.1, APIs: 2, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadContext.KERNEL32(?,00000000), ref: 02BB420F
ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 02BB42D7

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID: ContextMemoryProcessReadThread
String ID:
API String ID: 1264303914-0
Opcode ID: 79c7f39224a96a4a725d059de58663d900aa4ccda31392e6121f4d44a5d6bc25
Instruction ID: 6f43e7f8a7c4514db7fe449c2966535986cab15ce9fea0489377019676b418ea
Opcode Fuzzy Hash: 79c7f39224a96a4a725d059de58663d900aa4ccda31392e6121f4d44a5d6bc25
Instruction Fuzzy Hash: 383135B29002099FDB00CF9AD945BEEFBF4FF48324F14846AE558A3241D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BB3E1C Relevance: 1.6, APIs: 1, Instructions: 147
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(?,?,00000009,?,?,?,?,?,?,?), ref: 02BB3F7B

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 32a89a0c4bac7a6cde6672e09c618a0749bb3408ea905a612be93d720ac40ff0
Instruction ID: 6384e8c03e7a8b1d4b1d88e55c9fa52e7743f372157a84b66ada84bf75d138a9
Opcode Fuzzy Hash: 32a89a0c4bac7a6cde6672e09c618a0749bb3408ea905a612be93d720ac40ff0
Instruction Fuzzy Hash: 84512871900318DFDB21CF99C880BDDBBB5BF48314F14849AE808A7250DB75AA89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02BB0D44 Relevance: 1.6, APIs: 1, Instructions: 146
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(?,?,00000009,?,?,?,?,?,?,?), ref: 02BB3F7B

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 48a39f5f127a91e6938ee61119f8d58220a51147882d487dd4809df34bc5a3eb
Instruction ID: a3837a2b24f506f7a334869e11ceffb98cd8eb2a4b3c4a483c1cad9d7c612e9a
Opcode Fuzzy Hash: 48a39f5f127a91e6938ee61119f8d58220a51147882d487dd4809df34bc5a3eb
Instruction Fuzzy Hash: BA511771901318DFDB21CF99C890BDDBBB5BF48314F1484DAE908A7250DB75AA89CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0110DF8C Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0110E0AA

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9f16504589ba5a613c6fd1cb99bcd7c273ad28dd86713960de58da2cac6e8cb7
Instruction ID: 31a0f3cd8c2de69e29b9057d6d19e9ed188fc1ddd8782157446a9d3da1b550a3
Opcode Fuzzy Hash: 9f16504589ba5a613c6fd1cb99bcd7c273ad28dd86713960de58da2cac6e8cb7
Instruction Fuzzy Hash: 1651D2B1D01309DFDB15CF9AC884ADEBFB5BF88314F24862AE415AB250D7B59845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0110DF98 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0110E0AA

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2955f073efc89655afccdbd84bbff4e0466865f39beb89f729b97ee68d245331
Instruction ID: 52134417aee86b458d294ddbbf0e5be419485d6db7493049852ccc55e3968985
Opcode Fuzzy Hash: 2955f073efc89655afccdbd84bbff4e0466865f39beb89f729b97ee68d245331
Instruction Fuzzy Hash: 9141C1B1D01309DFDB19CF9AC884ADEBFB5BF88310F24852AE519AB250D7B59845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02BB44E0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 02BB4575

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ea82e564e115d2dd48f9044aeca4100754318a9f58b4e9f1ae35618ad52caf0a
Instruction ID: 4322c435228446e8b5a0afa0847de9217ffba62a29edc8742e4bc213cebc972d
Opcode Fuzzy Hash: ea82e564e115d2dd48f9044aeca4100754318a9f58b4e9f1ae35618ad52caf0a
Instruction Fuzzy Hash: 0F2155B1900249DFCB00CFAAC885BDEBBF8FF48310F04842AE818A7241D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BB4190 Relevance: 1.6, APIs: 1, Instructions: 69
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadContext.KERNEL32(?,00000000), ref: 02BB420F

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 87205f5af2545962d6ba1cfcb866afee69981bcde67451bc940932bb22c7df5a
Instruction ID: 307a670918a64c97da0ff564e0ca830bea394d8e9c27d9a24f7c4be07203eb82
Opcode Fuzzy Hash: 87205f5af2545962d6ba1cfcb866afee69981bcde67451bc940932bb22c7df5a
Instruction Fuzzy Hash: 97210571D006199FCB00CF9AD8857EEFBF4FF48224F14816AE818B7641D778A9458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BB44E8 Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 02BB4575

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ff7a557626659877efebb5140aa0cd58afce9bb106971bf83f8642b3f55b6bf6
Instruction ID: 12449c77a76cd05c8a479ba0909a0695e6d1fa21476270a2047bcefb7478bb98
Opcode Fuzzy Hash: ff7a557626659877efebb5140aa0cd58afce9bb106971bf83f8642b3f55b6bf6
Instruction Fuzzy Hash: 492116B1900649DFCB10CF9AD885BDEBBF8FF48314F04842AE518A7251D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011070D0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0110715F

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 394fa4af73f6b695950444334e01c59fd6b226005ae6ce8903e7c63cd9c04dc6
Instruction ID: 937a55520d883d8a61ac106c7829e8564567f4539bf687542f53b48f81ce6ad2
Opcode Fuzzy Hash: 394fa4af73f6b695950444334e01c59fd6b226005ae6ce8903e7c63cd9c04dc6
Instruction Fuzzy Hash: A121F4B5D00208AFDB10CFA9D985ADEBFF5EB48310F14841AE954A3250D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011070D8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0110715F

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cca6254b92f5c6429328a66026e94f4423414120d31a1ed4c6ca63763da09385
Instruction ID: d4de0610d459bb2d9dbf309ad34a71898dfb9c77979d4c9528da055224778ccc
Opcode Fuzzy Hash: cca6254b92f5c6429328a66026e94f4423414120d31a1ed4c6ca63763da09385
Instruction Fuzzy Hash: D421C4B5D00208AFDB11CFAAD984ADEFBF9FB48324F14841AE954A3350D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BB4258 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 02BB42D7

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ae32004ede7a4824ccb5b507547d17d426213cc5b57054b6c16617a354fc431d
Instruction ID: e1ecf69d6a09ed449d7993c22610335ec0479d230621cf5f8c4c3cf7a4037c2a
Opcode Fuzzy Hash: ae32004ede7a4824ccb5b507547d17d426213cc5b57054b6c16617a354fc431d
Instruction Fuzzy Hash: 7821D0B5900249DFCB10CF9AD984BDEBBF4FF48324F14842AE958A3250D378A954DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BB4198 Relevance: 1.6, APIs: 1, Instructions: 58threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNEL32(?,00000000), ref: 02BB420F

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 1ca76d76554f98f0523ba86d850ca97fae0ae90c7278189ec68a0a3ba6174ef0
Instruction ID: 6310f781dc42a7e00295eef7406419689d14b610e94781f17db0fe5b68da293c
Opcode Fuzzy Hash: 1ca76d76554f98f0523ba86d850ca97fae0ae90c7278189ec68a0a3ba6174ef0
Instruction Fuzzy Hash: DA2106B1D006199FCB00CF9AD9857EEFBF8FF48224F14816AE418B3641D778A9448FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0110B2F0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0110C1A9,00000800,00000000,00000000), ref: 0110C3BA

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 289dec954fddd7a53f75365a6c20ce836e26db65904b1897f17296a0b1da69b0
Instruction ID: fbb75879990064623616a091fd468606f6d9fdc3f32c2b0e6dad92161d5e2ebd
Opcode Fuzzy Hash: 289dec954fddd7a53f75365a6c20ce836e26db65904b1897f17296a0b1da69b0
Instruction Fuzzy Hash: 451122B6C042088FDB14CF9AD444BDEFBF8AB88310F04852AE515A7240C3B4A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08E5C2B0 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 08E5C323

Memory Dump Source

Source File: 00000000.00000002.389105149.0000000008E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e50000_Purchase Order.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5dfec97c095069e298097e12bc49304d7f6ecf40eae460c2c0050a95d4e3d3c9
Instruction ID: fdc26a116826a211ebf272d3c23467419938955524209a95d63ae2c4725207cc
Opcode Fuzzy Hash: 5dfec97c095069e298097e12bc49304d7f6ecf40eae460c2c0050a95d4e3d3c9
Instruction Fuzzy Hash: AF2117719003099FCB10CF9AC484BDEFBF4FB48320F148429E958A3240D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BB4320 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 02BB4393

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 058c9f6ce765f648e24c1d8ff574029acfdd14d210bccf7299a7ebaba48d133d
Instruction ID: 398e4401fc7fc2339eaad7305d0906d02752f8af7eb4614cfe1baed082814c72
Opcode Fuzzy Hash: 058c9f6ce765f648e24c1d8ff574029acfdd14d210bccf7299a7ebaba48d133d
Instruction Fuzzy Hash: 1B216472800248DFCB11CF9AD884BDEBBF4FF48314F148869E529A7201D375A454CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0110C34F Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0110C1A9,00000800,00000000,00000000), ref: 0110C3BA

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0ceea91a53e45953f45e2c111ce9e3a272d2e656c25d735d330c0ab44e693620
Instruction ID: b004acfffe5944e2eb26219d3aa9f1d60622a2d2769ce70b59595817a4122969
Opcode Fuzzy Hash: 0ceea91a53e45953f45e2c111ce9e3a272d2e656c25d735d330c0ab44e693620
Instruction Fuzzy Hash: 841114B6C002088FDB14CFAAD444BDEFBF4AB88310F14852ED515A7640C3B4A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BB4328 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 02BB4393

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bce4a5d7430e6b1feba2e559af4a6799ceab5e819beb6303cc242017680fa633
Instruction ID: 8e7e82c1ae3fa624a865b91bdda15aa6ee71b84206002d419b759b0a06167666
Opcode Fuzzy Hash: bce4a5d7430e6b1feba2e559af4a6799ceab5e819beb6303cc242017680fa633
Instruction Fuzzy Hash: 8C1125B6900248DFCB10CF9AD884BDEBBF8FF48324F148419E528A7250C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0110C0C7 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0110C12E

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6de0f77886bbe66907a42e4a47fd8771aa8108d136723990c2eac1692d63fca8
Instruction ID: 3b4afc4d4ca82a93659995c7ceb33a9a319858e72595e0392158d3b6bba85395
Opcode Fuzzy Hash: 6de0f77886bbe66907a42e4a47fd8771aa8108d136723990c2eac1692d63fca8
Instruction Fuzzy Hash: 031102B1C00649CEDB14CF9AC444BDEFBF4AF88224F14855AD469A7640C378A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0110C0C8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0110C12E

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1fd25841d2fe093146ce2f5801e8710a21fb44a024c23a6469733d06b5068bdd
Instruction ID: 3f921e45bb3e8d6a375d863d017c6e827ecc3c82e56239cdebd4a762c3eacdaa
Opcode Fuzzy Hash: 1fd25841d2fe093146ce2f5801e8710a21fb44a024c23a6469733d06b5068bdd
Instruction Fuzzy Hash: F511E3B5C00649CFDB14CF9AC844BDEFBF4AF88224F14855AD529A7640C378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0110E1D8 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0110E23D

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 6eb8d3e3804941fc56076aa24dcffca8ea82531f30ab70ca754c3058644bcef6
Instruction ID: e6b8489c137c3f53197b8c1be95f6c72d0237677648e519dce93215f0c0dd404
Opcode Fuzzy Hash: 6eb8d3e3804941fc56076aa24dcffca8ea82531f30ab70ca754c3058644bcef6
Instruction Fuzzy Hash: 731122B58002098FDB10DF9AD584BDEBBF8FB48324F24841AD964B7340C3B4A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BB4698 Relevance: 1.5, APIs: 1, Instructions: 45threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 02BB46FF

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a1fea7f59499f4489e27dc683f63ff3424a4bd323954b2650a0b0e457022b549
Instruction ID: 5596f1b56ccab932d4ab6d6b40d0e5185e370f6a8db950c135228504af27dfa8
Opcode Fuzzy Hash: a1fea7f59499f4489e27dc683f63ff3424a4bd323954b2650a0b0e457022b549
Instruction Fuzzy Hash: 9A1133B18002488FCB11CF9AD4847DEFBF4EF49324F148459D518A7740C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0110E1E0 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0110E23D

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 343650d1acc876f5745c380cf907086967b156c4d5138127f2e25ee985027c3e
Instruction ID: a2286a4ae52e4482a8092953ef6587499f83ada69da8374b3f137aa02a934891
Opcode Fuzzy Hash: 343650d1acc876f5745c380cf907086967b156c4d5138127f2e25ee985027c3e
Instruction Fuzzy Hash: 341100B5C002088FDB10CF9AD584BDEBBF8EB88324F14841AE915A3240C3B4A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BB46A0 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 02BB46FF

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9e35a2359cf9d80a3ead80d8d0e2f980de2bf6888d8126eafacaf8291214fe26
Instruction ID: 94ba27853e3d7d12a1c5fdc118c90a89aff8142c0c945881bb1886392df1ce8d
Opcode Fuzzy Hash: 9e35a2359cf9d80a3ead80d8d0e2f980de2bf6888d8126eafacaf8291214fe26
Instruction Fuzzy Hash: AC1112B18002088FCB10CF9AD588BDEFBF8FF49324F24845AD528A3640D775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 010AD4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382501862.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ad000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be56ee497e603f76322d74bdb381f5a44b209b559d011ee15124edf1e52bf4c8
Instruction ID: 92e6befce0fa9215425b12b114578159fed765c9254faa275e3ee035ab79fb45
Opcode Fuzzy Hash: be56ee497e603f76322d74bdb381f5a44b209b559d011ee15124edf1e52bf4c8
Instruction Fuzzy Hash: 53217C71500200DFCF05CFE4C9C4B6ABFA5FB88328F6485ADD9850B616C336D846C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 010BD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382541747.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10bd000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4585905b32253874dd3f6f3c798fc11519e5a3519be8c21841202f73205630d
Instruction ID: 3c052f1dcef10081578b19144c1d060a8a1e3f721e6810f0d269456173725a05
Opcode Fuzzy Hash: c4585905b32253874dd3f6f3c798fc11519e5a3519be8c21841202f73205630d
Instruction Fuzzy Hash: A1212571504200DFCB15CF94D9C4B66FBA5FB84368F24C9ADE9890B246C73AD847CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010BD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382541747.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10bd000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 870283f524c678abcfc5de89022180077be257b2cbf6135817e137025dae5ebd
Instruction ID: ab246c58f6f9133a29e62caaf634ddb6b3c3bf7f9bffede0c47b259fabd0d476
Opcode Fuzzy Hash: 870283f524c678abcfc5de89022180077be257b2cbf6135817e137025dae5ebd
Instruction Fuzzy Hash: 84210771504280EFDB05DF94D9C0B66FBA5FB94328F24C9ADD9894B242C736D846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010BD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382541747.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10bd000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e6d9005f517568b682a6fa76152836902b1633189d2fdb8e37038ffc2a7cf0
Instruction ID: 54367d632a41063af513b96aa35970b3fdd09b8358ae50ee7cdc0d5ce6772161
Opcode Fuzzy Hash: e2e6d9005f517568b682a6fa76152836902b1633189d2fdb8e37038ffc2a7cf0
Instruction Fuzzy Hash: 532141755083809FCB12CF54D994B11BFB1EB46214F28C5EAD8858B267C33A9856CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010AD4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382501862.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ad000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f0594bee8868593b253288601a07ef2959b201ea6725fd913386ffcdecb2b8
Instruction ID: 12bd65709c3f5935473d6fb9ecc717acccc0ac75639c01c1b8d0d3f67816cc73
Opcode Fuzzy Hash: 80f0594bee8868593b253288601a07ef2959b201ea6725fd913386ffcdecb2b8
Instruction Fuzzy Hash: 9A11D376404280CFCF12CF94D5C4B16BFB1FB84324F2486A9D8850B657C33AD55ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 010BD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382541747.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10bd000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1dbedae0698d52e0643ce1b7d8e11560290ac4443e7eb4d9f0d1352bf0b3008
Instruction ID: 2ae154db0771fdb814e0862998176f2e4a0a38a499c8ee364225d8fe62c1dc4d
Opcode Fuzzy Hash: f1dbedae0698d52e0643ce1b7d8e11560290ac4443e7eb4d9f0d1352bf0b3008
Instruction Fuzzy Hash: 0011A975504280DFCB52CF54C6C0B55FFA1FB84228F28C6A9D8894B656C33AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 010AD771 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382501862.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ad000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ada55d9f08218d6b4a6ee5e3220e4569ee3b77938c706ec3f0c2b5e65790636
Instruction ID: 8fb3b4db3b8c7e043acb8e674fc83e90157bc304ac386ae52780870aad1112de
Opcode Fuzzy Hash: 2ada55d9f08218d6b4a6ee5e3220e4569ee3b77938c706ec3f0c2b5e65790636
Instruction Fuzzy Hash: 0701FC310043849EE7154AD9CC8476EFFDCFF41664F488899ED450A682E7789844C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 010AD770 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382501862.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ad000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e27093a5cd2c1bdd2f351695f49360f1bb00f4376da19c6f8cc5ecf6a6cc53
Instruction ID: da02b409516dd37d31fcceba993573229d160971ea2097a98b7bd1c8b96ccaef
Opcode Fuzzy Hash: 51e27093a5cd2c1bdd2f351695f49360f1bb00f4376da19c6f8cc5ecf6a6cc53
Instruction Fuzzy Hash: 67F0C2714043849EEB158A59CD84B66FFE8EB41634F18C59AED484F682D3789844CBB0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0110FAB0 Relevance: 3.9, Strings: 3, Instructions: 184COMMON

Download Yara Rule

Strings

ssr, xrefs: 0110FC98
$%^m, xrefs: 0110FAFD
ssr, xrefs: 0110FC9F

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID:
String ID: $%^m$ssr$ssr
API String ID: 0-1799261603
Opcode ID: c248575ecfe99997aa98f7ca490c34d56008b2ac8c5469ade1bff5d4a5add5f4
Instruction ID: 9df946501b6f4d6adc3c618c376560fd00ad08139969e776a1a1bbe273f4800f
Opcode Fuzzy Hash: c248575ecfe99997aa98f7ca490c34d56008b2ac8c5469ade1bff5d4a5add5f4
Instruction Fuzzy Hash: D9813774E0420ADFCB18CFA5E5959EEFBB2FF89200F10992AD415BB254D774AA02CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02BB21E8 Relevance: 2.7, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

1Et3, xrefs: 02BB2400
:@P, xrefs: 02BB2347

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID:
String ID: 1Et3$:@P
API String ID: 0-623094759
Opcode ID: dbba2f795dd8ed4f402da83f274cbafdeb6f98965da2a25f51a0f7e2325fd9ff
Instruction ID: afd983e0998b1a26e87ab7f1b86e04d2d8cbfa996d66a57ae59847b3ce7d933e
Opcode Fuzzy Hash: dbba2f795dd8ed4f402da83f274cbafdeb6f98965da2a25f51a0f7e2325fd9ff
Instruction Fuzzy Hash: AB813674E0520A9FCF05CFA9D8815EEFBB2EF89200F20946AC915F7264D7749A42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0110FAA0 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

$%^m, xrefs: 0110FAFD

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID:
String ID: $%^m
API String ID: 0-665390657
Opcode ID: c983f07b5a013101c00a467ef2d709668e757028aeecc93f65425abb79e52ba8
Instruction ID: 15e0f0cce2291d8602411937654ff80a0cb4b3c6c83c1f9b7ba6c42fda7bbfe7
Opcode Fuzzy Hash: c983f07b5a013101c00a467ef2d709668e757028aeecc93f65425abb79e52ba8
Instruction Fuzzy Hash: 2F711874E0420ADFCB18CFA5E5959AEFBB2FF89200F10992AD415BB394D7749A02CF51

Uniqueness

Uniqueness Score: -1.00%

Function 08E588E0 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

., xrefs: 08E5893F

Memory Dump Source

Source File: 00000000.00000002.389105149.0000000008E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e50000_Purchase Order.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-3301801010
Opcode ID: 030e7c9e555de7d96c7c025353b1b81416b7606bb4f4950884a58acc9ec23e1b
Instruction ID: 934f1d23f9f0cac9de7e4da5b0aef2f3cca17c22f7c2ffd535a72bef0c8e4032
Opcode Fuzzy Hash: 030e7c9e555de7d96c7c025353b1b81416b7606bb4f4950884a58acc9ec23e1b
Instruction Fuzzy Hash: 41511C75D0561A8FCB48CFAAC4815EFFBF2BF98340F14D42AC819A7254D73496428F95

Uniqueness

Uniqueness Score: -1.00%

Function 08E588F0 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

., xrefs: 08E5893F

Memory Dump Source

Source File: 00000000.00000002.389105149.0000000008E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e50000_Purchase Order.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-3301801010
Opcode ID: e1db2e8e2cd0408b9f73ced0e9919f01bc10b99d6bd3fd1bf3fae52aea3f0b4f
Instruction ID: fcf9294d93d2a8b16bdd8fc2dd8fdccd1221b109f23ac60292ea43cf865aaecf
Opcode Fuzzy Hash: e1db2e8e2cd0408b9f73ced0e9919f01bc10b99d6bd3fd1bf3fae52aea3f0b4f
Instruction Fuzzy Hash: B751EA71D0461A9FCB48CFAAC4815EFFBF2AB98340F24D429C919B7254D73496428F95

Uniqueness

Uniqueness Score: -1.00%

Function 02BB72E7 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef691a910df8931c954c9796dd1f4ea41fd7b807039d0638182701bee2c5c176
Instruction ID: 44b6fd985cb4364f6df9f4c63c531c221e4e4530533a0c1f68381c483a107a75
Opcode Fuzzy Hash: ef691a910df8931c954c9796dd1f4ea41fd7b807039d0638182701bee2c5c176
Instruction Fuzzy Hash: B6C1BD32B016058FDB1ADB79C4607AEB7E7AFC9208F1444A9D14ACB391CFB5E905CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0110C828 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1639f682270a543eb096b1f5575faf3c1b6be0a004e6006af8b98074b78e9a7a
Instruction ID: 86820d681fa1f6f927508bee35f20f8969427d6000b6c9e8cafc9db8880b1dab
Opcode Fuzzy Hash: 1639f682270a543eb096b1f5575faf3c1b6be0a004e6006af8b98074b78e9a7a
Instruction Fuzzy Hash: 0912EAF96117468FE335CF6AE8981893BB8B755328F904308D2616FAD8D7B4314ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 01109D10 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f306b293bbbe9f95c4150615f80fd6a5e8618aeda977618754327bb1bd435b1c
Instruction ID: 8e3a3052f577a64642926d22ceaec84c905d2adcccf5d03286d8d8df86a925bc
Opcode Fuzzy Hash: f306b293bbbe9f95c4150615f80fd6a5e8618aeda977618754327bb1bd435b1c
Instruction Fuzzy Hash: 4DA1B136E0021ACFCF1ADFB5C8445DEBBB2FF85304B15856AE905BB260EB71A915CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0110C827 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f7b1f01a612a4a19356a7168f5ced220f54342dd8b9a5875bc2bdc8c95a4433
Instruction ID: efb22dc3ba8e9290c16a296254c60607417a48c9f7ccef72b821b3eeafb36eaf
Opcode Fuzzy Hash: 5f7b1f01a612a4a19356a7168f5ced220f54342dd8b9a5875bc2bdc8c95a4433
Instruction Fuzzy Hash: 2AC17FF5A117468FE335DF6AE8881897BB9FB85328F504308D2616B6D8D7B4344ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 0110FD8A Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382645328.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214133241fb5c8dc315367403ab86149ef1a460f4d1a69b896b90e25514b52fb
Instruction ID: 1064ef21b0d7e5dd984193b33e3eb273103f40431ad283e3f1bd27ef72881bd9
Opcode Fuzzy Hash: 214133241fb5c8dc315367403ab86149ef1a460f4d1a69b896b90e25514b52fb
Instruction Fuzzy Hash: 57614874E0420ADFCB18CFA4E5859AEFBB1FF89201F10996AD415BB294D774AA02CF51

Uniqueness

Uniqueness Score: -1.00%

Function 08E56C80 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389105149.0000000008E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 08E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e50000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e2a3a06d7a42b148b1fa86bb805b31d7c655dc25b3c60b0bb9445c86114fa9
Instruction ID: 36e621b19f06e71d834210152b5e7e5c8c84eb52a021318651386ebc183a7d75
Opcode Fuzzy Hash: 00e2a3a06d7a42b148b1fa86bb805b31d7c655dc25b3c60b0bb9445c86114fa9
Instruction Fuzzy Hash: 37411571E146199FCB04CF9AC9408EEFBF2FF89211F54A56AD819B7225D7309A41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02BB1918 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.382812791.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06b970d6132b974b9646c15b1ac9fc46ca24b5bd5cc25c7b324deae10162a00
Instruction ID: d71249652dd11ed7b7d3e8105fb13d97fbf95e13bb462a4fc792c6d580ebd017
Opcode Fuzzy Hash: d06b970d6132b974b9646c15b1ac9fc46ca24b5bd5cc25c7b324deae10162a00
Instruction Fuzzy Hash: B7110671E116198BDB08CFABE9406EEFBF7AFC8210F14C17AD508A7214DB704A028F91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Purchase Order.exePID: 4848, Parent PID: 4872COMMON

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	86
Total number of Limit Nodes:	5

Executed Functions

Function 011D6B50 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 011D6BB0
GetCurrentThread.KERNEL32 ref: 011D6BED
GetCurrentProcess.KERNEL32 ref: 011D6C2A
GetCurrentThreadId.KERNEL32 ref: 011D6C83

Memory Dump Source

Source File: 00000007.00000002.569263109.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11d0000_Purchase Order.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: eb24d45492e2250942ceab03c1f0375a048149606f676f0dc5058049b2c8c976
Instruction ID: c45535d1852f8588cb6254763f5d0e2ccab45379737e53b1279d1642c607611e
Opcode Fuzzy Hash: eb24d45492e2250942ceab03c1f0375a048149606f676f0dc5058049b2c8c976
Instruction Fuzzy Hash: 6A5135B0A00649CFDB14CFA9C648BDEBBF4EF88314F208499E159A7350D7746944CF66

Uniqueness

Uniqueness Score: -1.00%

Function 011D5184 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 011D52A2

Memory Dump Source

Source File: 00000007.00000002.569263109.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11d0000_Purchase Order.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f414e9a4020e6947f26455a335915cb0e84046650738b2fe78c58a01493b6947
Instruction ID: 94e45736814f7982f477c94e87caa3eac932d06acf77610a242e07bdeec327d2
Opcode Fuzzy Hash: f414e9a4020e6947f26455a335915cb0e84046650738b2fe78c58a01493b6947
Instruction Fuzzy Hash: 8F51D0B1D10309DFDB14CF99C884ADEBFB6BF98314F24812AE819AB210D7749845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 011D5190 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 011D52A2

Memory Dump Source

Source File: 00000007.00000002.569263109.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11d0000_Purchase Order.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5e30782f0f72c6bb38f6500055fd5bd861a876b7d943ea8aed6bd01b46690b79
Instruction ID: 8a6b7ad8bf90afab432409c8ab3a226b867158bea555dab9a18f31d06161ebd4
Opcode Fuzzy Hash: 5e30782f0f72c6bb38f6500055fd5bd861a876b7d943ea8aed6bd01b46690b79
Instruction Fuzzy Hash: C941B0B1D10309DFDB18CF99C884ADEBFB6BF88314F24812AE919AB210D7749845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 011D6964 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 011D7CF9

Memory Dump Source

Source File: 00000007.00000002.569263109.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11d0000_Purchase Order.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 7c238724e1810bf484a7d46e27977cf439e3141d3195cbab2bf549638bd3a79a
Instruction ID: 3bc16efec8235869bf29d2207139d09c0f4243b6d2c8a0830fcd29dc3790b97c
Opcode Fuzzy Hash: 7c238724e1810bf484a7d46e27977cf439e3141d3195cbab2bf549638bd3a79a
Instruction Fuzzy Hash: 34414BB5900605CFDB18CF99C488BAABBF5FF88318F258459D519AB361D734A841CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011DC3A9 Relevance: 1.6, APIs: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 011DC432

Memory Dump Source

Source File: 00000007.00000002.569263109.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11d0000_Purchase Order.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 420665d059aac42397a60a80b31fd9f184839ce24fb0f55e79bbcaeee3f285e5
Instruction ID: d5450b3a04ce804b3ae436a17016adc924e9f519e28814a73d1d317f1e2393b4
Opcode Fuzzy Hash: 420665d059aac42397a60a80b31fd9f184839ce24fb0f55e79bbcaeee3f285e5
Instruction Fuzzy Hash: 1831E2718043458FDB10DFA8D5483EEBFF0AB59318F28885EC888A7342C7755849CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011D6D72 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011D6DFF

Memory Dump Source

Source File: 00000007.00000002.569263109.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11d0000_Purchase Order.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5a9f8606f47f254153c7edf1e0307d37800401b0b4f8e3a81527b6d53ad6f89c
Instruction ID: dc0398eaebf35ae152ec403afd757e9b957c9874c9b2ac1fb1db7eb2a40558aa
Opcode Fuzzy Hash: 5a9f8606f47f254153c7edf1e0307d37800401b0b4f8e3a81527b6d53ad6f89c
Instruction Fuzzy Hash: FE21E3B59002589FDB10CFA9D984AEEFFF4EB48324F14841AE954A3210D378A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011D6D78 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011D6DFF

Memory Dump Source

Source File: 00000007.00000002.569263109.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11d0000_Purchase Order.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c12ced4a377102bde3accae24e6b53a98874c8be4feb781f9ff052f80f8ddcd2
Instruction ID: 4506649999687d6606ca0cc9e9ece95aa09ca6e5b12dc6a94270554f2010a452
Opcode Fuzzy Hash: c12ced4a377102bde3accae24e6b53a98874c8be4feb781f9ff052f80f8ddcd2
Instruction Fuzzy Hash: 7621C2B5900218DFDB10CFAAD984ADEBBF8EB48324F14841AE914A7310D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011DC3B8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 011DC432

Memory Dump Source

Source File: 00000007.00000002.569263109.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11d0000_Purchase Order.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: fdfa3f20b6f5eaa9d2eb8ba343470049f4553da57906f288acdc143368609f5a
Instruction ID: e815cd2ed810844b7f5b4703731cd192f2d23d654efa1f1aab9bde8514b6e3b5
Opcode Fuzzy Hash: fdfa3f20b6f5eaa9d2eb8ba343470049f4553da57906f288acdc143368609f5a
Instruction Fuzzy Hash: B71179719407058FDB10DFAAD5487AEBFF8EB48314F24882ED449A7641C738A949CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD53C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.568936484.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fcd000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbdd899738f200a8299cc849bee624dafe217fac0f769107e472c91127d41505
Instruction ID: 09ccc1016f9322413233763fac8ccec0addd7c06ae146c66de1011a230f5819f
Opcode Fuzzy Hash: cbdd899738f200a8299cc849bee624dafe217fac0f769107e472c91127d41505
Instruction Fuzzy Hash: 09210672500241DFCB05DF54DAC1F2ABFA5FB98328F28897DE8054B246C336D856E7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD450 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.568936484.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fcd000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ad7e3450715879776edcdac51b0779daaf780dba74895bb5bd9ca3519d1a44
Instruction ID: 7cd5f26e14f968a80351b55aacedff4294feec96bfe0283f2f363ac25f8b68d1
Opcode Fuzzy Hash: d2ad7e3450715879776edcdac51b0779daaf780dba74895bb5bd9ca3519d1a44
Instruction Fuzzy Hash: C6213672500201DFCB08DF50DAC1F2BBB65FB84324F24897CD9050B246C336E846E7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00FDD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.569025246.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fdd000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227e9f9091a3f166e83ce1580b599de075cd72eafe37db64941df8d1419dae75
Instruction ID: bf1be76be821b9fb325715a35e3c75051722087dedeec6ab9d58ba265d944a34
Opcode Fuzzy Hash: 227e9f9091a3f166e83ce1580b599de075cd72eafe37db64941df8d1419dae75
Instruction Fuzzy Hash: A221F571504240DFCB14DF54D9C8B26BBA6FBC4324F28C96ED8494B34AC73AD847DA62

Uniqueness

Uniqueness Score: -1.00%

Function 00FDD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.569025246.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fdd000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f0644943b0e79fe21c5cc57218256ee96783f20ad81e85ece89300906c796d2
Instruction ID: dabf0667e0cc0f5628d5460b18b72f4b5aed38f35d23e4577d01dcbb46f52e20
Opcode Fuzzy Hash: 2f0644943b0e79fe21c5cc57218256ee96783f20ad81e85ece89300906c796d2
Instruction Fuzzy Hash: C92153755093C08FCB12CF24D594715BF71EB46324F29C5EBD8458B6A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD537 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.568936484.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fcd000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f0594bee8868593b253288601a07ef2959b201ea6725fd913386ffcdecb2b8
Instruction ID: 2867e02edb30477e0dd56463e78bb187d0330872ba06f1d7ebb5336e8214a0a0
Opcode Fuzzy Hash: 80f0594bee8868593b253288601a07ef2959b201ea6725fd913386ffcdecb2b8
Instruction Fuzzy Hash: 4411B476904240CFCF12CF10D6C4B1ABF71FB94324F2885ADD8454B656C33AD456DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD44B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.568936484.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fcd000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f0594bee8868593b253288601a07ef2959b201ea6725fd913386ffcdecb2b8
Instruction ID: 8bcaf255b500b0f078d832eed522018c0d5001ed519c8146999326faf0f5ef7d
Opcode Fuzzy Hash: 80f0594bee8868593b253288601a07ef2959b201ea6725fd913386ffcdecb2b8
Instruction Fuzzy Hash: D611AF76904280CFCF16CF14DAC4B1ABF71FB84324F2886ADD8050B656C336D85ADBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: tKZVPq.exePID: 5416, Parent PID: 3352COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	193
Total number of Limit Nodes:	18

Executed Functions

Function 07F5C588 Relevance: 25.1, Strings: 18, Instructions: 2609COMMON

Download Yara Rule

Strings

Nk, xrefs: 07F5E8B5
Nk, xrefs: 07F5EAAB
Nk, xrefs: 07F5EC73
Nk, xrefs: 07F5ED34
Nk, xrefs: 07F5EE70
Nk, xrefs: 07F5EA25
Nk, xrefs: 07F5EB2B
Nk, xrefs: 07F5EC26
Nk, xrefs: 07F5EDD2
Nk, xrefs: 07F5E9B0
Nk, xrefs: 07F5E92A
Nk, xrefs: 07F5EFCF
Nk, xrefs: 07F5E7E4
Nk, xrefs: 07F5E865
<bm, xrefs: 07F5CB5E
<bm, xrefs: 07F5C941
Nk, xrefs: 07F5EF0E
Nk, xrefs: 07F5EBB1

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID: <bm$<bm$Nk$Nk$Nk$Nk$Nk$Nk$Nk$Nk$Nk$Nk$Nk$Nk$Nk$Nk$Nk$Nk
API String ID: 0-2217615921
Opcode ID: 69f2e5b7ff6249570b8082d3cfdd624861e85d0ac5b2052c6322f15f8fb88de2
Instruction ID: d8e609a839debd68f3ce6c940408774dff747e1dd3e69687a9904dedb01a944c
Opcode Fuzzy Hash: 69f2e5b7ff6249570b8082d3cfdd624861e85d0ac5b2052c6322f15f8fb88de2
Instruction Fuzzy Hash: 344307B4E012198FDB24DF68C888A9DB7B6BF49304F1985D9D919AB365CB30ED81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07F57B90 Relevance: 10.9, Strings: 8, Instructions: 896COMMON

Download Yara Rule

Strings

D0bm, xrefs: 07F57FE4
D0bm, xrefs: 07F58071
Nk, xrefs: 07F580F5
Nk, xrefs: 07F57FF5
Nk, xrefs: 07F58057
Nk, xrefs: 07F58157
Nk, xrefs: 07F57FA3
D0bm, xrefs: 07F58171

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID: D0bm$D0bm$D0bm$Nk$Nk$Nk$Nk$Nk
API String ID: 0-4226866508
Opcode ID: 1decceb1167474a41c188e66765e057aa7562f26bc149a0586979b9b7dd845a5
Instruction ID: 02424e2b4c3177f5b98644f1cc74be4c20c76a37e64ab5c54fd964355f0779c0
Opcode Fuzzy Hash: 1decceb1167474a41c188e66765e057aa7562f26bc149a0586979b9b7dd845a5
Instruction Fuzzy Hash: C47290B0A00119CFCB14DFA8C844AAEBBF6BF89344F198569E915EB355DB30DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07F5BAB0 Relevance: 4.5, Strings: 3, Instructions: 722COMMON

Download Yara Rule

Strings

Nk, xrefs: 07F5C3C1
Nk, xrefs: 07F5BDD5
Nk, xrefs: 07F5BE5B

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID: Nk$Nk$Nk
API String ID: 0-771949547
Opcode ID: 364de81fa61a43379dee3c946edd50642d97591786a9cdaa21e40f076e71178c
Instruction ID: 09175db795ab7f03ec3272ef42f460b17ce29d870907f8d77a7ef364363be4e3
Opcode Fuzzy Hash: 364de81fa61a43379dee3c946edd50642d97591786a9cdaa21e40f076e71178c
Instruction Fuzzy Hash: 055261B1B0021A9FCB18DFA9C494AADB7B6FF85314B198169ED06DB364DB30DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07F588E0 Relevance: .9, Instructions: 910COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47fa281d6576b50360740e7ae6f851a2d42554d16122c5c6ab8fbedf6966beac
Instruction ID: b01500e84032c3f6c914a0cab8c5712b3c1b21a43e10482b2ff76b910074b601
Opcode Fuzzy Hash: 47fa281d6576b50360740e7ae6f851a2d42554d16122c5c6ab8fbedf6966beac
Instruction Fuzzy Hash: 7A826DB1A0020ADFCB14CFA8C584AAEBBF6BF88354F198559EA45DB361D770EC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A7BEE8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

lnk, xrefs: 00A7C066
lnk, xrefs: 00A7C08B

Memory Dump Source

Source File: 00000011.00000002.542126415.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_a70000_tKZVPq.jbxd

Similarity

API ID: HandleModule
String ID: lnk$lnk
API String ID: 4139908857-1122313549
Opcode ID: f5c55a3785b80754afb2d2bb4739f633026c26f1a2aaf2896725a12c1ae5358e
Instruction ID: e2bd29e85832f50538959f25c5a46ec7e7c42bb4fbdbe1f495dee2d870e742e9
Opcode Fuzzy Hash: f5c55a3785b80754afb2d2bb4739f633026c26f1a2aaf2896725a12c1ae5358e
Instruction Fuzzy Hash: C37154B0A00B058FDB24DF69C94579AB7F5BF88314F008A2DE44AD7A40DB35E846CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07F5B477 Relevance: 5.2, Strings: 4, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xcbm, xrefs: 07F5B54E
Xcbm, xrefs: 07F5B58F
Xcbm, xrefs: 07F5B583
Xcbm, xrefs: 07F5B540

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID: Xcbm$Xcbm$Xcbm$Xcbm
API String ID: 0-2151507559
Opcode ID: 47691fc209bd404d5108ee7a1bb335366f66a2df662604625e5260ebbb77a401
Instruction ID: 0e74abb80736ff29906535a4bb32290e68ee6a142b025486b96a5907bcc3890e
Opcode Fuzzy Hash: 47691fc209bd404d5108ee7a1bb335366f66a2df662604625e5260ebbb77a401
Instruction Fuzzy Hash: 40618EB5B001199FCB149FA8D455AED7BF6EF89715F184069EA02AB394CB30DC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07F5FC90 Relevance: 3.8, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$,bm, xrefs: 07F5FD57
ID, xrefs: 07F5FD01
$,bm, xrefs: 07F5FD27

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID: ID$$,bm$$,bm
API String ID: 0-3712926452
Opcode ID: 9b35fd3541b39047b1ca149160b696d1406578ac9c566da351d84f922bc3afce
Instruction ID: 8bad70eb31c3629bd68b3bff1752353d81a797c5907533d673e3236f1892e99a
Opcode Fuzzy Hash: 9b35fd3541b39047b1ca149160b696d1406578ac9c566da351d84f922bc3afce
Instruction Fuzzy Hash: 8121F6B1B142099FCB549BB8D81567A7BE5EF89204F1849B6EA05DB385DB30CD02C792

Uniqueness

Uniqueness Score: -1.00%

Function 07F5FCA0 Relevance: 3.8, Strings: 3, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$,bm, xrefs: 07F5FD57
ID, xrefs: 07F5FD01
$,bm, xrefs: 07F5FD27

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID: ID$$,bm$$,bm
API String ID: 0-3712926452
Opcode ID: 49d46b35ade9f0a5aeaebeb3b1152eaa8cf75ee18c7f77ebac7085c26d3f7a80
Instruction ID: 0b2460ef96cf0519506775de5c6b4acd491068d9c70e5d1674011d75ab9a3b3e
Opcode Fuzzy Hash: 49d46b35ade9f0a5aeaebeb3b1152eaa8cf75ee18c7f77ebac7085c26d3f7a80
Instruction Fuzzy Hash: 3E21F3B1B101099FC7549BB8D81577E76E6EFC9204F1448BADA06DB384DB30DD028792

Uniqueness

Uniqueness Score: -1.00%

Function 07F59DD0 Relevance: 2.1, Strings: 1, Instructions: 824
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Nk, xrefs: 07F5AA63

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID: Nk
API String ID: 0-1353404103
Opcode ID: ad9f324c9b9ce3dda31eef9ce48709458bf616f0cb808b63cbead8b39c9ab22d
Instruction ID: 60b9cd30b1cd40c2882a2bfaa9a0d830369a51fe418cc4e54f57dc9aa2dad06f
Opcode Fuzzy Hash: ad9f324c9b9ce3dda31eef9ce48709458bf616f0cb808b63cbead8b39c9ab22d
Instruction Fuzzy Hash: 34728E70A0021D9FEB649BA4C850BDEBBB7BF84304F1484AED506AB798CB309E45DF55

Uniqueness

Uniqueness Score: -1.00%

Function 02263D41 Relevance: 1.7, APIs: 1, Instructions: 159processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 02263EEB

Memory Dump Source

Source File: 00000011.00000002.542357681.0000000002260000.00000040.00000800.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2260000_tKZVPq.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 68db33b97f915dde214b29bacb131d9f06fdc677938e965ac3a21347c03eaa04
Instruction ID: bd1e7702f07fb3e3a757e7ef2e15bf75b8e0d0c0cfed9d2ba37630d83f6062fd
Opcode Fuzzy Hash: 68db33b97f915dde214b29bacb131d9f06fdc677938e965ac3a21347c03eaa04
Instruction Fuzzy Hash: A0612871D00319DFDB10CF99C984BEDBBB5BF48714F1485AAE908A7250CB319A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02260CB4 Relevance: 1.6, APIs: 1, Instructions: 146processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 02263EEB

Memory Dump Source

Source File: 00000011.00000002.542357681.0000000002260000.00000040.00000800.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2260000_tKZVPq.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 26e7e1f401d5f09d4542899420de373f147530df146deb1bb2823e9efe8d13b4
Instruction ID: aee123283f6230b31539594dcc1a658ed828e3d852c9f9e731019d52d6931746
Opcode Fuzzy Hash: 26e7e1f401d5f09d4542899420de373f147530df146deb1bb2823e9efe8d13b4
Instruction Fuzzy Hash: 0D510871D00319DFDB20CF99C884BDDBBB5BF88714F1484AAE908A7250DB719A89CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02263D8D Relevance: 1.6, APIs: 1, Instructions: 145processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 02263EEB

Memory Dump Source

Source File: 00000011.00000002.542357681.0000000002260000.00000040.00000800.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2260000_tKZVPq.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d6f33a740e2df65f04675aa5cc2a5821889c27033c8567d0b5b53e25775efa09
Instruction ID: 06b6391a37ea4c326155d0d1462521d7c48d287b0c58df0b3b833fdb2b3ea655
Opcode Fuzzy Hash: d6f33a740e2df65f04675aa5cc2a5821889c27033c8567d0b5b53e25775efa09
Instruction Fuzzy Hash: 5F512871D00319DFDB10CF99C884BDDBBB5BF88714F1484AAE508A7250CB719A89CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00A7B410 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00A7E0AA

Memory Dump Source

Source File: 00000011.00000002.542126415.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_a70000_tKZVPq.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5f3cf0dd7443da7948c333f83075414254258acbb0f849398c3627ab37e0a5d7
Instruction ID: 2738fd51410be5df1a2701b48026d02cf297de61a03a08aaef78ba9170b74853
Opcode Fuzzy Hash: 5f3cf0dd7443da7948c333f83075414254258acbb0f849398c3627ab37e0a5d7
Instruction Fuzzy Hash: 8D51F2B1C00349DFDB14CFA9C894ADEBBB5FF88314F24822AE519AB210D7749846CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00A7B42C Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00A7E0AA

Memory Dump Source

Source File: 00000011.00000002.542126415.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_a70000_tKZVPq.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d82735ec5347efe9ca0738f757c4744e74e6ec4fc07fd360ca638f4b812946f0
Instruction ID: 12f147d20a9ba6629ec08d7bd6f91e7b47a63a5c3923af235afcb503cd7da721
Opcode Fuzzy Hash: d82735ec5347efe9ca0738f757c4744e74e6ec4fc07fd360ca638f4b812946f0
Instruction Fuzzy Hash: 2851D0B1D10309DFDB14CF9AC884ADEBBB5BF88314F24822AE519AB210D7B49845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00A7DF8C Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00A7E0AA

Memory Dump Source

Source File: 00000011.00000002.542126415.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_a70000_tKZVPq.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ccd21ece4fd18e2c084e946b61cf6de62be7cedbbe2926af9cf0ff2c7880fc7d
Instruction ID: 8c5ba6f54820aa6752400c868802292e92bb097046044d3dbd40591aea5d6ce3
Opcode Fuzzy Hash: ccd21ece4fd18e2c084e946b61cf6de62be7cedbbe2926af9cf0ff2c7880fc7d
Instruction Fuzzy Hash: 1E51D2B1D10349DFDB14CF9AC884ADEFBB5BF88314F24856AE419AB210D7749986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00A7E1A1 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,00A7E1C8,?,?,?,?), ref: 00A7E23D

Memory Dump Source

Source File: 00000011.00000002.542126415.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_a70000_tKZVPq.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 34a1dc221713a4b230ece3ebe1b55dece9ce8aa29c423ff4da4fd3308581d086
Instruction ID: 4ab636d739fb38d3c8f2499b23c7b234329a7e653713b33dc48bb0089cb3a4d8
Opcode Fuzzy Hash: 34a1dc221713a4b230ece3ebe1b55dece9ce8aa29c423ff4da4fd3308581d086
Instruction Fuzzy Hash: 3E219AB5800249DFDB11CFA5E845BDEBBF4EF49324F08C09AD448A7212C734A905CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0226433A Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 022643CD

Memory Dump Source

Source File: 00000011.00000002.542357681.0000000002260000.00000040.00000800.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2260000_tKZVPq.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 544a630d83f0e072ed973260265a1765b8a55b218b37d44f564d0f0ee8c36c32
Instruction ID: 4438e8612398216bf89c1322f9f60cb84a1472f8831b359de38b60a768e4d658
Opcode Fuzzy Hash: 544a630d83f0e072ed973260265a1765b8a55b218b37d44f564d0f0ee8c36c32
Instruction Fuzzy Hash: 002125B1900209DFCB10CF9AD989BDEBBF4FF48314F14842AE958A7240D338A594CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02264340 Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 022643CD

Memory Dump Source

Source File: 00000011.00000002.542357681.0000000002260000.00000040.00000800.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2260000_tKZVPq.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 28ccf8294728cddb54b5a912c67b1f49d60daa41eba2ff30bbed9c416065b89b
Instruction ID: b8bd5c22cf9fb16ee8e7c2cec24a51140757716d0b9c77dd42adc7c10f60578e
Opcode Fuzzy Hash: 28ccf8294728cddb54b5a912c67b1f49d60daa41eba2ff30bbed9c416065b89b
Instruction Fuzzy Hash: B92136B1900209DFCB10CF9AD884BDEBBF4FB48314F14842AE958A7240D374A994CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A76AA4 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00A7709E,?,?,?,?,?), ref: 00A7715F

Memory Dump Source

Source File: 00000011.00000002.542126415.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_a70000_tKZVPq.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0a37c5e5011db4ef98079afbe370b77760d8afa48933ea7fc4cd2465f43777a5
Instruction ID: 35dccf85a654419e875036f60680e98b06fd161c3fc202d524cf97c116b01c60
Opcode Fuzzy Hash: 0a37c5e5011db4ef98079afbe370b77760d8afa48933ea7fc4cd2465f43777a5
Instruction Fuzzy Hash: 8721E5B5900208AFDB10CFAAD984ADEFBF8EB48314F14851AE914A3310D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 022641C0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02264247

Memory Dump Source

Source File: 00000011.00000002.542357681.0000000002260000.00000040.00000800.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2260000_tKZVPq.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 987ed591efbd38c9eeb2512a3df8f5231a118dcc8a8580de3cfa51ec9f2bba8b
Instruction ID: 26f9c02e6e2792a43e13d39eb75d92413cda46c3d98357a9ed1d35a7408d2e45
Opcode Fuzzy Hash: 987ed591efbd38c9eeb2512a3df8f5231a118dcc8a8580de3cfa51ec9f2bba8b
Instruction Fuzzy Hash: F321F5B1901249DFCB10DF9AD984ADEFBF4FF48314F54842AE558A3210D374A554CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A770D0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00A7709E,?,?,?,?,?), ref: 00A7715F

Memory Dump Source

Source File: 00000011.00000002.542126415.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_a70000_tKZVPq.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e149855439913e6ddee751217b984ddd66f4cf4e7598b831c326cac410c0983a
Instruction ID: 9b17cb019614e09727a44341bee56160b7f7f3a89baa87ab8844909f8162c3c5
Opcode Fuzzy Hash: e149855439913e6ddee751217b984ddd66f4cf4e7598b831c326cac410c0983a
Instruction Fuzzy Hash: A221E6B5900209DFDB10CFAAD984ADEFBF4FB48314F14851AE954A7310C374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02264100 Relevance: 1.6, APIs: 1, Instructions: 61threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 0226417F

Memory Dump Source

Source File: 00000011.00000002.542357681.0000000002260000.00000040.00000800.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2260000_tKZVPq.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 8c4d0e1b7c9f3cd2b913035e6aa99a1f0edc93f4949e50c76f691ac43977c4dc
Instruction ID: b5e8359c0eca607b03b1f71cae54b404323d0089c4bf197a40c82a6b9753c72d
Opcode Fuzzy Hash: 8c4d0e1b7c9f3cd2b913035e6aa99a1f0edc93f4949e50c76f691ac43977c4dc
Instruction Fuzzy Hash: 312129B1D1061A9FCB10DF9AD9497EEFBF4FB48214F14816AD418B3640D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 022641C8 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02264247

Memory Dump Source

Source File: 00000011.00000002.542357681.0000000002260000.00000040.00000800.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2260000_tKZVPq.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8837316fb16817863d706d8e892d4e97d442de0d0c8d61a187ca0fe7da006525
Instruction ID: 4dfbf8543ba148796930975065429080f25e06c9ac7b04f1a02dc8b46e7de6b0
Opcode Fuzzy Hash: 8837316fb16817863d706d8e892d4e97d442de0d0c8d61a187ca0fe7da006525
Instruction Fuzzy Hash: 4021D0B1900259DFCB10CF9AD984ADEFBF4FB48324F14842AE968A3250D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02264108 Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 0226417F

Memory Dump Source

Source File: 00000011.00000002.542357681.0000000002260000.00000040.00000800.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2260000_tKZVPq.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: cece8f1052fea10317e234b62ea367aaf286a57272588f96e9c685b3c9178f4d
Instruction ID: d8d7d195033d8a4775c37a4431119a125480803b28b1065a1a0e572e036f8f5c
Opcode Fuzzy Hash: cece8f1052fea10317e234b62ea367aaf286a57272588f96e9c685b3c9178f4d
Instruction Fuzzy Hash: 31214AB1D106199FCB10CF9AC9457EEFBF8FB48214F148169D418B3640D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07FAC2B0 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 07FAC323

Memory Dump Source

Source File: 00000011.00000002.551928198.0000000007FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7fa0000_tKZVPq.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3753b1fa5483404110d029fe878efd0db63be2394ea3c8efa80a4f097aa939a9
Instruction ID: e1e426c7834c8f97d7314567e1749a0e3bb7f031d1478f5d24c72de46dbca612
Opcode Fuzzy Hash: 3753b1fa5483404110d029fe878efd0db63be2394ea3c8efa80a4f097aa939a9
Instruction Fuzzy Hash: CF21D6B5D006499FCB10CF9AD984BDEFBF4FB48324F148429E558A7250D374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A7B2F0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00A7C1A9,00000800,00000000,00000000), ref: 00A7C3BA

Memory Dump Source

Source File: 00000011.00000002.542126415.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_a70000_tKZVPq.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 52bca995c5c578916a120034b0dfb82d334b47d9b6532b5aebc844e2a2f02500
Instruction ID: ed2a56db476ac3b64dc8e1a792095c644b9feb28b2272fa1116fb4f4d61e211c
Opcode Fuzzy Hash: 52bca995c5c578916a120034b0dfb82d334b47d9b6532b5aebc844e2a2f02500
Instruction Fuzzy Hash: F211D3B69002099FDB10CF9AD844BDEFBF4AB88324F14C52ED519BB600C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A7C348 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00A7C1A9,00000800,00000000,00000000), ref: 00A7C3BA

Memory Dump Source

Source File: 00000011.00000002.542126415.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_a70000_tKZVPq.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b6e486b3594549a873a933a29bd0ae233da9047bb2ef51755a39b12f0a766ba3
Instruction ID: 29b4d5921b91326ccbdb63d079f00773cb9dc98da903e7238cad393f7d1c6e1d
Opcode Fuzzy Hash: b6e486b3594549a873a933a29bd0ae233da9047bb2ef51755a39b12f0a766ba3
Instruction Fuzzy Hash: 4811E4B6900209CFDB10CF9AD444ADEFBF5AB88324F14C42ED559A7640C375A945CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 02264290 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02264303

Memory Dump Source

Source File: 00000011.00000002.542357681.0000000002260000.00000040.00000800.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2260000_tKZVPq.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b321d61731b9f597df351a8f65c679f2869ddf25c4b4205f207656db3b01689e
Instruction ID: e5538cbba7347610fb4593309bc0cc3711df28b331141fdd9954f83605443ba6
Opcode Fuzzy Hash: b321d61731b9f597df351a8f65c679f2869ddf25c4b4205f207656db3b01689e
Instruction Fuzzy Hash: 5B113776900249DFCB20DFDAD948BEEBFF4EB48324F148419E558A7210C334A994CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A7B298 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,00A7BEFB), ref: 00A7C12E

Memory Dump Source

Source File: 00000011.00000002.542126415.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_a70000_tKZVPq.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9d2de0554e1f35bd37f06e5c54dd10828b492974dbae505b9d359e32843cb52e
Instruction ID: ef8b53185202d3a20a3815c2caffde8ed03cc6985c03888eec5838f44a8d37f8
Opcode Fuzzy Hash: 9d2de0554e1f35bd37f06e5c54dd10828b492974dbae505b9d359e32843cb52e
Instruction Fuzzy Hash: 9111C0B6D006498BDB20CF9AC844BDEFBF4EB88324F14C52ED569A7601D374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02264298 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02264303

Memory Dump Source

Source File: 00000011.00000002.542357681.0000000002260000.00000040.00000800.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2260000_tKZVPq.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0e7b41ab23d441f3118d65238cb66ec7d145c3722ec9716116185cc8365520bf
Instruction ID: f59ac0be57934884aeeab3469e36caf14aeb4e5ea2e208739b4c9ef50c337aca
Opcode Fuzzy Hash: 0e7b41ab23d441f3118d65238cb66ec7d145c3722ec9716116185cc8365520bf
Instruction Fuzzy Hash: C711E675900649DFCB10DF9AD948BDEBBF4FB48324F148419E568A7210C375A554CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A7B464 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,00A7E1C8,?,?,?,?), ref: 00A7E23D

Memory Dump Source

Source File: 00000011.00000002.542126415.0000000000A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_a70000_tKZVPq.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 377bb520bc82c897a9d138b50aa1e4bfc360a3083274684e0b6d6fed9eb6357c
Instruction ID: f60b17c6d80f7b382f780972022509db1dc3b114c7c6a27b69f3db26648a0251
Opcode Fuzzy Hash: 377bb520bc82c897a9d138b50aa1e4bfc360a3083274684e0b6d6fed9eb6357c
Instruction Fuzzy Hash: 3811F5B59002089FDB10DF9AD985BDEBBF8EB88324F148559EA59A7201C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 022644F1 Relevance: 1.5, APIs: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 02264557

Memory Dump Source

Source File: 00000011.00000002.542357681.0000000002260000.00000040.00000800.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2260000_tKZVPq.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2786ba7b6092a3ba1113e75aae128c8f61b4ef4d02c8fb3155814bfb4c7e9320
Instruction ID: cd7044d8a72a2bbeed37b96c389e40ecb62aee8d9236beaf20a326308e79181e
Opcode Fuzzy Hash: 2786ba7b6092a3ba1113e75aae128c8f61b4ef4d02c8fb3155814bfb4c7e9320
Instruction Fuzzy Hash: EC1115B1900249CFCB20DF9AD548BDEFBF4EB88324F24845AD568A7210C374A985CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 022644F8 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 02264557

Memory Dump Source

Source File: 00000011.00000002.542357681.0000000002260000.00000040.00000800.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2260000_tKZVPq.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 712d1dae311385eb0b0425915e3d0e33ff12e7008433154eed10ce6cf4249876
Instruction ID: 10a772c3f450607d626d76b1fe9de4220434813e2416dc4d3fa0277b0bdae259
Opcode Fuzzy Hash: 712d1dae311385eb0b0425915e3d0e33ff12e7008433154eed10ce6cf4249876
Instruction Fuzzy Hash: 4C112AB1800249CFCB10DF9AD548BDEFBF4EB48324F148419D568A3200C374A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07F5BBEF Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

Nk, xrefs: 07F5BC33

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID: Nk
API String ID: 0-1353404103
Opcode ID: 424fdfdc99900b330705d6c8159f1880f3e8b11fa58f4bb95f1c14158688c36b
Instruction ID: 9b92811067854640ae9406838929cb0330b6c8bb0d3a63005e62334ca14eccdb
Opcode Fuzzy Hash: 424fdfdc99900b330705d6c8159f1880f3e8b11fa58f4bb95f1c14158688c36b
Instruction Fuzzy Hash: 06413AB0B0011AAFCF149F64D849AAEB7A7EFC4314F198428ED02973A4DB34DC52CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07F5AC20 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc1058c8b8f7a1d5a32dee3a20ce886f9cc4341746028dbfdc142bf2919520cd
Instruction ID: a0bc293e08060592a2f42bd769e00e9aaa35fb550d4f240a55b5aea94def82ed
Opcode Fuzzy Hash: bc1058c8b8f7a1d5a32dee3a20ce886f9cc4341746028dbfdc142bf2919520cd
Instruction Fuzzy Hash: A2D11BB5E001198FCB04DF69C98499DBBF6FF88310B1AC1A9EA15AB361CB31EC51CB55

Uniqueness

Uniqueness Score: -1.00%

Function 07F5AAFF Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dcb7d804d9b59086b8b6a1aba0aa788115fbf1aa9c0f566fb5865af016abc3c
Instruction ID: a860927b3c208359a0bfdfbbaadb1c552cc3adfed95df1a73faaa98a2bf7bfcf
Opcode Fuzzy Hash: 9dcb7d804d9b59086b8b6a1aba0aa788115fbf1aa9c0f566fb5865af016abc3c
Instruction Fuzzy Hash: 57C1FBB5E001198FCB04DFA9C98899DBFF6BF88310B1AC159EA15AB361C734EC51CB95

Uniqueness

Uniqueness Score: -1.00%

Function 07F59668 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9b41b11266af9497cecbb481b8c420120c021d3e47d163ab481056f8e502de
Instruction ID: d0b676a740d5519a441ad382574272ef2eb529ea5f7d4e15ddf92a6ef228a379
Opcode Fuzzy Hash: cb9b41b11266af9497cecbb481b8c420120c021d3e47d163ab481056f8e502de
Instruction Fuzzy Hash: D851A3B5724116CFC708DF39D88496A7BE9FF8925570A44B6EA06CB362DB61EC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07F5F965 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e5293abebf2b2459b20271c6f1b3069e05b79ffc458566cefac9ba9800fdca
Instruction ID: ea2296a3a48ba6935f8fdf30f64bfed2045736382de1710acd49682dba674931
Opcode Fuzzy Hash: 01e5293abebf2b2459b20271c6f1b3069e05b79ffc458566cefac9ba9800fdca
Instruction Fuzzy Hash: 6D51D7B0B042959FDB00DBB8C8257BE7BE2EF85315F1484A6DA01DB389DB348D41C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 07F5F9B0 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9406ca7a564a107130593ca665867c2d500af884540b92ca85695444f4f075c4
Instruction ID: afa05cfa1f8a9920d19ba33c21477c7327ffc26610712bd278b4d8810ee15f3a
Opcode Fuzzy Hash: 9406ca7a564a107130593ca665867c2d500af884540b92ca85695444f4f075c4
Instruction Fuzzy Hash: E541D7B0B001599FDB04DBB4C8157BE76E2EF88305F148466DA06EB389DB348D01C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 07F59467 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 587b05ade0aa810ea76d01e8a3f57b2de1328d141c995144288f81705d5e52ef
Instruction ID: 42b4f30d625cefc9890c34966afa34e6423e095495514a40490b285b22a76b49
Opcode Fuzzy Hash: 587b05ade0aa810ea76d01e8a3f57b2de1328d141c995144288f81705d5e52ef
Instruction Fuzzy Hash: C4414CB5A10219DFCB09DF28D998AAA3BF6BF89311F140069EA068B361C771ED50CB51

Uniqueness

Uniqueness Score: -1.00%

Function 07F598A9 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5dcc612dfea893ec10c18c262b37b124e4b99234ac30bff8d571955d4268851
Instruction ID: c1fb41de65f0f0e456b3be213c707b92f873a40cc872eb89a6115bcfe7bcec8f
Opcode Fuzzy Hash: b5dcc612dfea893ec10c18c262b37b124e4b99234ac30bff8d571955d4268851
Instruction Fuzzy Hash: 3721F3B1718216CBDB19A735C4542BD339BEFC5249F1C8039DA42CB395DFAADC428382

Uniqueness

Uniqueness Score: -1.00%

Function 07F597B0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7ed7ddb1eff5e131ffa9168ab6421e2a5e10a5dd555126a088cc33bde7c75b
Instruction ID: 4fd19bc3103cf39ffb0ca5e1e5688c8cf3962495b25b90fc56a58d516f114c0d
Opcode Fuzzy Hash: bb7ed7ddb1eff5e131ffa9168ab6421e2a5e10a5dd555126a088cc33bde7c75b
Instruction Fuzzy Hash: 0C21D8F1B0414ADFCB08DE65D8806BB7BEABB85241F494425EE16CB355D7B0E800CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07F5B8B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13e21a48733f1362ca7cef1004fc41ad1c7ee6219c9e78dc927cd9bbcda5a87
Instruction ID: 07e3eb6be0fe0a58a71e328d7ec1a75b09acb5b34f013d6a7dcfbb2c60458ab7
Opcode Fuzzy Hash: e13e21a48733f1362ca7cef1004fc41ad1c7ee6219c9e78dc927cd9bbcda5a87
Instruction Fuzzy Hash: E0216DB5B0420A8FCB10DFB8C484AADBBF5EF85214F194466EA05DB361D734E845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0069D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.541018395.000000000069D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0069D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_69d000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09e88b20fa1636d96b47383fdae7a8da0d0e501068fbc457d1fa53e6f0ff027f
Instruction ID: 922c6e0e9c9f36f72e3a7e3c914fb70af90ffb256d0ab9c475f6f436af197e18
Opcode Fuzzy Hash: 09e88b20fa1636d96b47383fdae7a8da0d0e501068fbc457d1fa53e6f0ff027f
Instruction Fuzzy Hash: 49212571500200DFCF05DF54D9C0B66BBAAFB98328F248579E9090B756C33AD856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 006BD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.541086837.00000000006BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6bd000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7a10c6b1a0ee4fd0d484a746f1e59d6ed02fd008971d0e4283f251217c1b6f4
Instruction ID: 8996fadfc318f92edf9497b2e868f1eb179dc39d441c203fb837fb9540f0301b
Opcode Fuzzy Hash: e7a10c6b1a0ee4fd0d484a746f1e59d6ed02fd008971d0e4283f251217c1b6f4
Instruction Fuzzy Hash: FB2103B1504200DFCB14EF54D9C4BA6BBA6EB84324F24C969D8090F346D73AD887CB61

Uniqueness

Uniqueness Score: -1.00%

Function 006BD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.541086837.00000000006BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6bd000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25169d6a57772afe381e7760c2383972f0417ea48118feb6e8705b3e8f8f3e2
Instruction ID: c95a1d63b95a55fb3cb8c0a7b8a3cd7f187babbd406a9c0d80a9d308c6ca9317
Opcode Fuzzy Hash: d25169d6a57772afe381e7760c2383972f0417ea48118feb6e8705b3e8f8f3e2
Instruction Fuzzy Hash: 682137B1504280EFCB05CF54C9C0BA6BBA6FB84318F20C96DDA094F342D736D986CB61

Uniqueness

Uniqueness Score: -1.00%

Function 07F5FBB8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd001129d89d82c9e8030a09b73a0fb5787a40e23890a181b873edb16086c7a7
Instruction ID: 113c3403948676688403ae290f4f7966972ed0c354be29ab5ab49e32349dac94
Opcode Fuzzy Hash: cd001129d89d82c9e8030a09b73a0fb5787a40e23890a181b873edb16086c7a7
Instruction Fuzzy Hash: 471106F3B1C11A9BD3088A2CCD5933A7ADAEB45214F0D89B7EF43CB2C1D674C9408690

Uniqueness

Uniqueness Score: -1.00%

Function 006BD006 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.541086837.00000000006BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6bd000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55db0ec552efc28accf60a112e18e31ed409cb13a79fcc1617e214d4e156b01e
Instruction ID: 09e6db86b32b584396944796e8fc9525f6c84dad9c1ea67c84382f0e16e24dd8
Opcode Fuzzy Hash: 55db0ec552efc28accf60a112e18e31ed409cb13a79fcc1617e214d4e156b01e
Instruction Fuzzy Hash: C121B0754083808FCB02DF20C990B41BF71EB46314F28C1DAC8488F2A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 07F581A8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7307edec665a0eecc5c5e13a9181091a859b4c88342e7e5c4c02f23e0037b7c2
Instruction ID: bcab47d3d31aeca6b2521a0605a86c22aa07e200010842a8096a35849eb48c6e
Opcode Fuzzy Hash: 7307edec665a0eecc5c5e13a9181091a859b4c88342e7e5c4c02f23e0037b7c2
Instruction Fuzzy Hash: CF21CDB1E00609DFCB24CF94C844BAABBF6EB08354F08C06AEA198B111D375D944CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0069D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.541018395.000000000069D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0069D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_69d000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f0594bee8868593b253288601a07ef2959b201ea6725fd913386ffcdecb2b8
Instruction ID: 4bee0062d61467d57a0836e12ad0d20fb315bd3d43008e58946a95ef4913fed9
Opcode Fuzzy Hash: 80f0594bee8868593b253288601a07ef2959b201ea6725fd913386ffcdecb2b8
Instruction Fuzzy Hash: 2C11AF76404280DFCF12CF14D5C4B56BF72FB94324F2486A9D8050B756C33AD85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 006BD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.541086837.00000000006BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6bd000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1dbedae0698d52e0643ce1b7d8e11560290ac4443e7eb4d9f0d1352bf0b3008
Instruction ID: e7bcd95368dceadc8a0dbc36992b0d2ba1c0688ed9589e1b6cf0fa07d47f4809
Opcode Fuzzy Hash: f1dbedae0698d52e0643ce1b7d8e11560290ac4443e7eb4d9f0d1352bf0b3008
Instruction Fuzzy Hash: 0B11A9B5504280DFCB12CF10C6C0B95BBA2FB84324F28C6A9D9494B756C33AD98ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0069D771 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.541018395.000000000069D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0069D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_69d000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbcb0722566698c02aacfe9b8cfd3ef2491636b92b89696ad5de0725a5706166
Instruction ID: e8a63e7d13782e62fe3eaf694fcea89f780669691ff46e65626a0de2bc5820fb
Opcode Fuzzy Hash: bbcb0722566698c02aacfe9b8cfd3ef2491636b92b89696ad5de0725a5706166
Instruction Fuzzy Hash: CD01F7310083449EEF104AE5CD847A6FBDCEF41764F18887AED050EB82C7789C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0069D770 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.541018395.000000000069D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0069D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_69d000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 364bbad5c369ee734a036b7fd1676e4b28c01d186b07769b5f8d17ac65be7f26
Instruction ID: a18b7bcef776e2e0f9f7e3efc9559cfbbff66ce29677b25722c7840973218424
Opcode Fuzzy Hash: 364bbad5c369ee734a036b7fd1676e4b28c01d186b07769b5f8d17ac65be7f26
Instruction Fuzzy Hash: D2F0C2714043849EEB108A56CD84BA6FFACEB41734F18C46AED080F782C3789844CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 07F5B420 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ee1f2a839173238b4efbdd742309b80b87faefad9a6aeb40c9a4a6bf4679080
Instruction ID: 105a30f0181dcddab32098c56eda7d3bf6787c5de9b210ad8209560c95d85551
Opcode Fuzzy Hash: 8ee1f2a839173238b4efbdd742309b80b87faefad9a6aeb40c9a4a6bf4679080
Instruction Fuzzy Hash: 84F0F9B590934DAFCB02DFA8E8056EEBFB1FF09210F0446AAE85496252D7714650DB91

Uniqueness

Uniqueness Score: -1.00%

Function 07F5B89F Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c10c70dcf9c2ac6c21429dec82eb18fa1365e6f4fd88f4d2a10e05ae3ab7fc
Instruction ID: 08c27955a0768a9254634d741d992ad6bb772b29b596c691cf14cfcf4860e6b8
Opcode Fuzzy Hash: e6c10c70dcf9c2ac6c21429dec82eb18fa1365e6f4fd88f4d2a10e05ae3ab7fc
Instruction Fuzzy Hash: A4F0EC756053495FCB1116B5FD496E67F64AB41161F04407BEA4085543D6308099C3B2

Uniqueness

Uniqueness Score: -1.00%

Function 07F5B430 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320536440241da271d2e6e40b8d5939db9919d8a91029b9c937bbd346aa06636
Instruction ID: e25a0d9ba35eceed4dedf978d4e3e878e440fab093488e6805383079a569f6dc
Opcode Fuzzy Hash: 320536440241da271d2e6e40b8d5939db9919d8a91029b9c937bbd346aa06636
Instruction Fuzzy Hash: F9F01CB4D0420DEFCF04DFE8D8016ADBBB5FB48300F008669E814A2351D7719660EF41

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07F52690 Relevance: 7.9, Strings: 6, Instructions: 410COMMON

Download Yara Rule

Strings

lnk, xrefs: 07F52944
lnk, xrefs: 07F527B1
lnk, xrefs: 07F5295D
lnk, xrefs: 07F52985
lnk, xrefs: 07F529A0
lnk, xrefs: 07F52A3A

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID: lnk$lnk$lnk$lnk$lnk$lnk
API String ID: 0-3204212817
Opcode ID: 6aad2d3b2ee8b7ae20d15596b217d1972a8c62a2825d99f25dee4ab5b7f71154
Instruction ID: 7902481adf387d554d9659ee05cf2a1dbdd6cf416eb87c811bb10242fd78e4bf
Opcode Fuzzy Hash: 6aad2d3b2ee8b7ae20d15596b217d1972a8c62a2825d99f25dee4ab5b7f71154
Instruction Fuzzy Hash: 72E1AFB0A002048FDB18DFA9C49469DBBF6EF89314F14856DE506EB395DF34AC46CB52

Uniqueness

Uniqueness Score: -1.00%

Function 07F56F0F Relevance: 7.8, Strings: 6, Instructions: 326COMMON

Download Yara Rule

Strings

Xcbm, xrefs: 07F57005
|gf^, xrefs: 07F56F11
Xcbm, xrefs: 07F5700F
Nk, xrefs: 07F57204
Nk, xrefs: 07F57162
Nk, xrefs: 07F57195

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID: Xcbm$Xcbm$|gf^$Nk$Nk$Nk
API String ID: 0-707201748
Opcode ID: 7fc4706c178ffcf11d51b28f81ae373d7888ccb3366fe837b95b4d1a6fa22e7c
Instruction ID: f55c3811b6aee2e9ab1782dd8c1aab85ad774274672791bc681b96cbc739ea74
Opcode Fuzzy Hash: 7fc4706c178ffcf11d51b28f81ae373d7888ccb3366fe837b95b4d1a6fa22e7c
Instruction Fuzzy Hash: 1DB107717042559FCB05AFB4D859BAE7BA6EF89318F084829EA05CB391DF34CC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07F5F188 Relevance: 6.6, Strings: 5, Instructions: 358COMMON

Download Yara Rule

Strings

Nk, xrefs: 07F5F4D6
Xcbm, xrefs: 07F5F43A
D0bm, xrefs: 07F5F2E1
Xcbm, xrefs: 07F5F448
Nk, xrefs: 07F5F2F2

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID: D0bm$Xcbm$Xcbm$Nk$Nk
API String ID: 0-3068094719
Opcode ID: e71f75ef97746012c61c913adfd64128267dde094d2776317a4c3abc6db592a3
Instruction ID: e8a9b1aee5d7c12030708e040b87fb87fb5613470b7d35fbfbd5a4d92b347208
Opcode Fuzzy Hash: e71f75ef97746012c61c913adfd64128267dde094d2776317a4c3abc6db592a3
Instruction Fuzzy Hash: 38C102B5B041158FCB19ABB8C4589BD3BE7AFCA614B1944EED606CB3A5CF70CC418792

Uniqueness

Uniqueness Score: -1.00%

Function 07F575B8 Relevance: 5.1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

Strings

Kbm, xrefs: 07F57615
Kbm, xrefs: 07F575D5
Kbm, xrefs: 07F575C9
Kbm, xrefs: 07F57609

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID: Kbm$Kbm$Kbm$Kbm
API String ID: 0-261881988
Opcode ID: 900dbe0a67e957baa9de0d84e538703ee2a2808f30c433dcd9248f30baa2cbe7
Instruction ID: 818ceabffe184bcd37df0127c5017a2cc5f9239e4976159993609c1a8ced7b3d
Opcode Fuzzy Hash: 900dbe0a67e957baa9de0d84e538703ee2a2808f30c433dcd9248f30baa2cbe7
Instruction Fuzzy Hash: 4D11A5B13046119F8B50EF7EE4D4A1A77DAAF8E65474440BCEA0ACB361DF61EC058BB1

Uniqueness

Uniqueness Score: -1.00%

Function 07F57B00 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

]m, xrefs: 07F57B32
]m, xrefs: 07F57B16
]m, xrefs: 07F57B3E
]m, xrefs: 07F57B0C

Memory Dump Source

Source File: 00000011.00000002.551849436.0000000007F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7f50000_tKZVPq.jbxd

Similarity

API ID:
String ID: ]m$]m$]m$]m
API String ID: 0-2738894597
Opcode ID: 5f881afaf976286a6444370f48662c3096be862092cc4e1c0f3fe1eefa0614c4
Instruction ID: 52e527253a9a9f992098d1172f780d6a50445f2486da1dd6e6971a8f7af010bd
Opcode Fuzzy Hash: 5f881afaf976286a6444370f48662c3096be862092cc4e1c0f3fe1eefa0614c4
Instruction Fuzzy Hash: B20188F1B100129F8764AE2DC454D5E73DAAFE576471A4165EA05CB378DA30DC418771

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: tKZVPq.exePID: 3416, Parent PID: 3352COMMON

Execution Graph

Execution Coverage:	13.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	162
Total number of Limit Nodes:	21

Executed Functions

Function 00E76EA0 Relevance: 6.1, APIs: 4, Instructions: 125
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00E76F10
GetCurrentThread.KERNEL32 ref: 00E76F4D
GetCurrentProcess.KERNEL32 ref: 00E76F8A
GetCurrentThreadId.KERNEL32 ref: 00E76FE3

Memory Dump Source

Source File: 00000013.00000002.551618476.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e70000_tKZVPq.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2b1b9f42ca6e9c8fc628cd7ccfb1f1b57033290ec9c75a32f3cff6cdfd46849f
Instruction ID: 3ebc3cf2346ee3f6cf0c97f66d9c4576a080627ac64f2d2949d5af22977390cc
Opcode Fuzzy Hash: 2b1b9f42ca6e9c8fc628cd7ccfb1f1b57033290ec9c75a32f3cff6cdfd46849f
Instruction Fuzzy Hash: 9F5154B4A00649CFDB14CFA9D5497EEBBF0EF88308F248469E059B7250D774A848CF26

Uniqueness

Uniqueness Score: -1.00%

Function 00E76EB0 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00E76F10
GetCurrentThread.KERNEL32 ref: 00E76F4D
GetCurrentProcess.KERNEL32 ref: 00E76F8A
GetCurrentThreadId.KERNEL32 ref: 00E76FE3

Memory Dump Source

Source File: 00000013.00000002.551618476.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e70000_tKZVPq.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7181ba4e74c3994e76243664d7f954a5851b5d2d8ffd84fa919d85c7695826b1
Instruction ID: 6c600b66eebaf8c4fa181e31afadbe363ccb37bff1e51c82f6a35e8e177eecf4
Opcode Fuzzy Hash: 7181ba4e74c3994e76243664d7f954a5851b5d2d8ffd84fa919d85c7695826b1
Instruction Fuzzy Hash: F05146B4A00649CFDB14CFAAD5487DEBBF0AF88318F20C469E059B7250D7746844CF66

Uniqueness

Uniqueness Score: -1.00%

Function 00E7BED8 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E7C12E

Memory Dump Source

Source File: 00000013.00000002.551618476.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e70000_tKZVPq.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 453be0c56687d619b4840daf874fea75e378dec5854fe4ee61457938f598b661
Instruction ID: 751fa70a1401a23c295d1f18563c7bace917032a4b1d21985fa2999becca8724
Opcode Fuzzy Hash: 453be0c56687d619b4840daf874fea75e378dec5854fe4ee61457938f598b661
Instruction Fuzzy Hash: 75814570A00B058FD724DF69C85579ABBF5BF88304F10892DE48AEBA51DB35E846CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04A33D41 Relevance: 1.7, APIs: 1, Instructions: 162
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 04A33EEB

Memory Dump Source

Source File: 00000013.00000002.554409749.0000000004A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4a30000_tKZVPq.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: beca0df6b8f186d0bfde12e95f9d9773e0565135359e9b95f0e0c4f466005a5f
Instruction ID: 48d1e77d9567714a7f6a5a78cab5501290d2c552aa7427d638177a5110edfd19
Opcode Fuzzy Hash: beca0df6b8f186d0bfde12e95f9d9773e0565135359e9b95f0e0c4f466005a5f
Instruction Fuzzy Hash: C9610571D04319DFDF50CFA9C880BDDBBB5AF48305F1484AAE908AB250DB31AA89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04A33D8D Relevance: 1.6, APIs: 1, Instructions: 148
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 04A33EEB

Memory Dump Source

Source File: 00000013.00000002.554409749.0000000004A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4a30000_tKZVPq.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 5144884874972b505d4b257a03b518a5313e8f509540a54bcbd39cbecab03558
Instruction ID: 34fc57833597391c35f80a3cef9ae4eca917fc8235bece0d7846d62565d5e0af
Opcode Fuzzy Hash: 5144884874972b505d4b257a03b518a5313e8f509540a54bcbd39cbecab03558
Instruction Fuzzy Hash: F1511971900319DFDF14CF99C880BDEBBB5BF88314F1485AAE908A7250DB71AA89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04A30CB4 Relevance: 1.6, APIs: 1, Instructions: 146
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 04A33EEB

Memory Dump Source

Source File: 00000013.00000002.554409749.0000000004A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4a30000_tKZVPq.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3f0b65eaeb756b5f58659912e117359275250857cbc7270d202fd5d30aedba15
Instruction ID: 464b495e9af6b2503b8c8125790fa71babe9c95bbb9ad83efbbbf6619ffd45a9
Opcode Fuzzy Hash: 3f0b65eaeb756b5f58659912e117359275250857cbc7270d202fd5d30aedba15
Instruction Fuzzy Hash: 1C510871904319DFDF50CF99C880BDEBBB5BF48315F1484AAE908A7250DB71AA89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E7DF8C Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00E7E0AA

Memory Dump Source

Source File: 00000013.00000002.551618476.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e70000_tKZVPq.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 88dbf74818994508cbc30d70bcab22d1fe2c3642434ce42d3ecb3683582324fa
Instruction ID: 8ba43cf2823dc0a4c3b56168f5daefe5fe0c0a2443db71626cb3b1e5264fb98e
Opcode Fuzzy Hash: 88dbf74818994508cbc30d70bcab22d1fe2c3642434ce42d3ecb3683582324fa
Instruction Fuzzy Hash: 0B51D0B1D00309DFDB14CF99C984ADEBBF5BF88314F25856AE818AB250D7749885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00E7DF98 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00E7E0AA

Memory Dump Source

Source File: 00000013.00000002.551618476.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e70000_tKZVPq.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9d3b77504c566290e2cd9b1e8bbc2ee89a5dd67c27bf27dbefbf60181c693e9b
Instruction ID: 7afaa6b28b8d035d55b8e13c2f25dcf44303f55a337b0fbf2a5b9c9a22bfded4
Opcode Fuzzy Hash: 9d3b77504c566290e2cd9b1e8bbc2ee89a5dd67c27bf27dbefbf60181c693e9b
Instruction Fuzzy Hash: 6341CEB1D00309DFDB14CF9AC884ADEBBF5BF88314F25852AE819AB250D7B59845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00E770D0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00E7715F

Memory Dump Source

Source File: 00000013.00000002.551618476.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e70000_tKZVPq.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 53de806f42eca12f17d3a3859b805662f3fa5dae14cd8408561e2252cc090b86
Instruction ID: 2f00589301862b2bd9f009bd4063d2f729f94e7c684d648734a7f5fef2bb26cd
Opcode Fuzzy Hash: 53de806f42eca12f17d3a3859b805662f3fa5dae14cd8408561e2252cc090b86
Instruction Fuzzy Hash: C221D2B59002099FDB10CFA9D985ADEBBF4EB48324F14841AE954A7350D374AA54CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E770D8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00E7715F

Memory Dump Source

Source File: 00000013.00000002.551618476.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e70000_tKZVPq.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5c0e93cf1ae9f8d26bc097dbecceb89ce228af597f5a08cdf146bbffee263afe
Instruction ID: efb30a58abb405a52adc5a6fd58db0db9df886477d1e1670c60118f7ef5e568c
Opcode Fuzzy Hash: 5c0e93cf1ae9f8d26bc097dbecceb89ce228af597f5a08cdf146bbffee263afe
Instruction Fuzzy Hash: 9D21C4B59012089FDB10CFAAD984ADEBBF8EB48324F14841AE954A7350D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E7C348 Relevance: 1.6, APIs: 1, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00E7C1A9,00000800,00000000,00000000), ref: 00E7C3BA

Memory Dump Source

Source File: 00000013.00000002.551618476.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e70000_tKZVPq.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e21f6df8e0918c64c0021e3e000bf7c1b88ba81a1643d132a2f5707bb04698f1
Instruction ID: a7f337d411622b0746e8942e81932810c0b8ae9612a898a0aacf4abc713b3d6a
Opcode Fuzzy Hash: e21f6df8e0918c64c0021e3e000bf7c1b88ba81a1643d132a2f5707bb04698f1
Instruction Fuzzy Hash: 5A1106B68003489FDB10CFAAD445ADEFBF4EB88324F14856ED559B7600C375A946CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00E7B2F0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00E7C1A9,00000800,00000000,00000000), ref: 00E7C3BA

Memory Dump Source

Source File: 00000013.00000002.551618476.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e70000_tKZVPq.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 405168e543332d9bb08d37d60c744b3d4a48cb17f405a3e88b5e7296e0d0863f
Instruction ID: dc5a42dd0c89ac1050056c1bece643e78785b88579037191ec2c9cc627e56ad3
Opcode Fuzzy Hash: 405168e543332d9bb08d37d60c744b3d4a48cb17f405a3e88b5e7296e0d0863f
Instruction Fuzzy Hash: AE11D6B69003099FDB10CF9AD444ADEFBF8AB88314F14846ED519B7600C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0843C2B0 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0843C323

Memory Dump Source

Source File: 00000013.00000002.556996295.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_8430000_tKZVPq.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ebdd13bf70bcedc57918d57b6e763597af19ec6483e39ea6af4093cdef1d5960
Instruction ID: 8cb4cad6fc29e29c02f328b129da20b30827191bd926e25d2c2af19eed6dab4a
Opcode Fuzzy Hash: ebdd13bf70bcedc57918d57b6e763597af19ec6483e39ea6af4093cdef1d5960
Instruction Fuzzy Hash: 4F2106B59002099FCB10DF9AC584BDEFBF4EB48320F14842AE558A7240D374A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E7C0C8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E7C12E

Memory Dump Source

Source File: 00000013.00000002.551618476.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_e70000_tKZVPq.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 87435ab79ac1700387a67f507c6c6529650cca3b62d7fe68b3bb3bb71084c14b
Instruction ID: 6dac53761f91725f7ab03aaf318bb91313c99aed5373e087dfd8ab0137a523f0
Opcode Fuzzy Hash: 87435ab79ac1700387a67f507c6c6529650cca3b62d7fe68b3bb3bb71084c14b
Instruction Fuzzy Hash: 1F11D2B5C006498FDB10CF9AC844ADEFBF8AB88324F15842AD429B7600D374A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: tKZVPq.exePID: 3732, Parent PID: 5416COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	61
Total number of Limit Nodes:	6

Executed Functions

Function 00F36B1F Relevance: 6.1, APIs: 4, Instructions: 139
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F36BB0
GetCurrentThread.KERNEL32 ref: 00F36BED
GetCurrentProcess.KERNEL32 ref: 00F36C2A
GetCurrentThreadId.KERNEL32 ref: 00F36C83

Memory Dump Source

Source File: 00000017.00000002.569272969.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f30000_tKZVPq.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f7f00308be2a8855f8209cdb7f813c2e0f5e4f0340ffcf02a189dce8cc683579
Instruction ID: 962c90fa98d606b35b87c1b082ebf7dabb597061c534f1115578e4607c87ffaa
Opcode Fuzzy Hash: f7f00308be2a8855f8209cdb7f813c2e0f5e4f0340ffcf02a189dce8cc683579
Instruction Fuzzy Hash: 0B5177B09047849FDB01CFA9DA48BDEBFF0EF49314F24849AD195A72A2C7745849CF62

Uniqueness

Uniqueness Score: -1.00%

Function 00F36B50 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F36BB0
GetCurrentThread.KERNEL32 ref: 00F36BED
GetCurrentProcess.KERNEL32 ref: 00F36C2A
GetCurrentThreadId.KERNEL32 ref: 00F36C83

Memory Dump Source

Source File: 00000017.00000002.569272969.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f30000_tKZVPq.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 24580a04f57f357678dedcbc04107a1b21a4430babbd94d1098de2121a30ab4d
Instruction ID: 523b7e62b104bf6ff1278eb5763944ba6d388a72211322843367812a8e2e7353
Opcode Fuzzy Hash: 24580a04f57f357678dedcbc04107a1b21a4430babbd94d1098de2121a30ab4d
Instruction Fuzzy Hash: EB5163B0900648DFDB10CFAAD648BDEBBF4EF88324F248459E159A7350CB746845CF66

Uniqueness

Uniqueness Score: -1.00%

Function 00F3510F Relevance: 1.7, APIs: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.569272969.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f30000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5ec69b19808425e51eb343f6e52cba03db072cc5e3bacf3bbb3803910b655dc
Instruction ID: 4c36b159171078c424d2d61b91678b0669a75abae95ed559963a4b90a568bdd8
Opcode Fuzzy Hash: c5ec69b19808425e51eb343f6e52cba03db072cc5e3bacf3bbb3803910b655dc
Instruction Fuzzy Hash: 536133B1C04349AFDF12CFA9C880ACEBFB1BF89320F15815AE908AB261C7359955DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F35190 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00F352A2

Memory Dump Source

Source File: 00000017.00000002.569272969.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f30000_tKZVPq.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 20f3549bd2c4eaee48ba8c3471ee420f07afcccbba30b455722a9b6416eeecc0
Instruction ID: c5df09f9c6cb10305227f6a6d48ee484dddf3870c4d1f53ab59f9c148281f40d
Opcode Fuzzy Hash: 20f3549bd2c4eaee48ba8c3471ee420f07afcccbba30b455722a9b6416eeecc0
Instruction Fuzzy Hash: CD41C0B1D003099FDF14CF9AC884ADEBBB5BF88714F24852AE819AB210D7749845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F36964 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 00F37CF9

Memory Dump Source

Source File: 00000017.00000002.569272969.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f30000_tKZVPq.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: f095f23a0879513cdcc0c17895526570459246eb85c30a3f3c1ae96b565ce470
Instruction ID: 652499e61fccdd971696ec6a16b9cf967603a0056b3507ab641da41530a31f32
Opcode Fuzzy Hash: f095f23a0879513cdcc0c17895526570459246eb85c30a3f3c1ae96b565ce470
Instruction Fuzzy Hash: FB4138B5900305CFDB14DF99C488AAABBF5FF88324F248458D519AB311C734A945DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F36D71 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F36DFF

Memory Dump Source

Source File: 00000017.00000002.569272969.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f30000_tKZVPq.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4b4f70888ae470a2c1126db23ed53428fe002e6a38943f220be528453f7b03b6
Instruction ID: c9f456618ffbe5035afdf2306a177804f92e8e9212a3e523ba55fdae30ad329a
Opcode Fuzzy Hash: 4b4f70888ae470a2c1126db23ed53428fe002e6a38943f220be528453f7b03b6
Instruction Fuzzy Hash: 2521E4B59002489FDB00CFA9D984ADEFBF4FB48324F14841AE954A3310C378A955DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F36D78 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F36DFF

Memory Dump Source

Source File: 00000017.00000002.569272969.0000000000F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_f30000_tKZVPq.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 87c4e3d1594684a54df8d5f6a02ac2a4cb0a831c09c9fac5b871fd5a468d46ec
Instruction ID: ae4fb2119b52bea0573b56cdefea4c90c01c4c948e02226ce5be5c5435ea3b78
Opcode Fuzzy Hash: 87c4e3d1594684a54df8d5f6a02ac2a4cb0a831c09c9fac5b871fd5a468d46ec
Instruction Fuzzy Hash: 6A21C2B5900208AFDB10CFAAD984ADEFBF8EB48324F14841AE914A7310D374A954DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00EDD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.569128055.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_edd000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16dd9527c2d2ff5fc44f8534eea49028e81c94b09e6445a9ed5b3111e00e7bf
Instruction ID: 2fd6086a0b1782d3c44907e3178f67181ac2336334786f18b12cd3c81b1eb1f9
Opcode Fuzzy Hash: c16dd9527c2d2ff5fc44f8534eea49028e81c94b09e6445a9ed5b3111e00e7bf
Instruction Fuzzy Hash: 5321D371508240DFCB14DF54DDC4B66BBA6EBC4318F24C96AD8495B346C73AD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00EDD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.569128055.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_edd000_tKZVPq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ed4449ca7fc0a1ca0993824ce9e254a0c413f6f83f2d96c25ff2051dc0fbf8
Instruction ID: ba8e15158ad5e97c516d0263b3091bad1ca9ffbf06990b9fdb4a3468c68d0525
Opcode Fuzzy Hash: d7ed4449ca7fc0a1ca0993824ce9e254a0c413f6f83f2d96c25ff2051dc0fbf8
Instruction Fuzzy Hash: DF217F7550D3808FCB12CF24D990715BF71EB86314F28C5EBD8498B6A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Purchase Order.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary

Jbx Signature Overview

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Order.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tKZVPq.exe.log

C:\Users\user\AppData\Local\Temp\tmp8E57.tmp

C:\Users\user\AppData\Local\Temp\tmpACD7.tmp

C:\Users\user\AppData\Local\Temp\tmpD0CA.tmp

C:\Users\user\AppData\Roaming\TRaCepbEuy.exe

C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe

C:\Users\user\AppData\Roaming\tKZVPq\tKZVPq.exe:Zone.Identifier

C:\Windows\System32\drivers\etc\hosts

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
Purchase Order.exe

Function 08E567D0 Relevance: 2.8, Strings: 2, Instructions: 302
COMMON

Function 08E5DD00 Relevance: 1.6, Strings: 1, Instructions: 357
COMMON