Windows Analysis Report
Proforma Inv.exe

Overview

General Information

Sample Name: Proforma Inv.exe
Analysis ID: 605000
MD5: 189ad2733ba3c8baa0d9fb41e4223d92
SHA1: 90d2762579dfd97d7b767662566f3a623766dd0a
SHA256: d73763f8b8d4eb91dec386eb7a2ebf9a8a9b40c6b028d57e6144ed74551d460b
Tags: agentteslaexe
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Yara detected AntiVM3
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
.NET source code contains very large strings
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Sigma detected: Suspicious Outbound SMTP Connections
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Found malware configuration
Source: 0.2.Proforma Inv.exe.3dff630.2.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "ipdepartment@safalaw.com.ph", "Password": "#Risel767", "Host": "mail.safalaw.com.ph"}
Multi AV Scanner detection for submitted file
Source: Proforma Inv.exe Virustotal: Detection: 33% Perma Link
Machine Learning detection for sample
Source: Proforma Inv.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 2.0.Proforma Inv.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 2.0.Proforma Inv.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 2.0.Proforma Inv.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 2.0.Proforma Inv.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 2.0.Proforma Inv.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8
Source: 2.2.Proforma Inv.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Uses 32bit PE files
Source: Proforma Inv.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: Proforma Inv.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_0CC19A90
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49756 -> 207.148.117.199:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.3:49756 -> 207.148.117.199:587
Source: Proforma Inv.exe, 00000002.00000002.510096392.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: Proforma Inv.exe, 00000002.00000002.510096392.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: Proforma Inv.exe, 00000002.00000002.510096392.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://WaIJyp.com
Source: Proforma Inv.exe, 00000002.00000002.510827489.0000000002E33000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://XudLs2COBNu.org
Source: Proforma Inv.exe, 00000002.00000003.279561854.0000000000C84000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://XudLs2COBNu.org1-5-21-3853321935-2125563209-4053062332-1002_Classes
Source: Proforma Inv.exe, 00000002.00000002.510735000.0000000002E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Proforma Inv.exe, 00000002.00000003.303946652.0000000000E39000.00000004.00000020.00020000.00000000.sdmp, Proforma Inv.exe, 00000002.00000003.303336669.0000000000E42000.00000004.00000020.00020000.00000000.sdmp, Proforma Inv.exe, 00000002.00000003.303909948.0000000000E24000.00000004.00000020.00020000.00000000.sdmp, Proforma Inv.exe, 00000002.00000003.303309343.0000000000E39000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Proforma Inv.exe, 00000002.00000002.510735000.0000000002E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Proforma Inv.exe, 00000002.00000002.510735000.0000000002E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: Proforma Inv.exe, 00000000.00000003.242880391.0000000005DB4000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242844157.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242766852.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242698082.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242656361.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242798809.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242392348.000000000145D000.00000004.00000020.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242863799.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242819494.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242737289.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://en.w
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: Proforma Inv.exe, 00000002.00000002.510735000.0000000002E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.safalaw.com.ph
Source: Proforma Inv.exe, 00000002.00000002.510735000.0000000002E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Proforma Inv.exe, 00000000.00000002.278940493.0000000005D90000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.249877134.0000000005D99000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Proforma Inv.exe, 00000000.00000003.249428709.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.249449455.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Proforma Inv.exe, 00000000.00000003.249167454.0000000005D99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com=
Source: Proforma Inv.exe, 00000000.00000003.249167454.0000000005D99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comF
Source: Proforma Inv.exe, 00000000.00000003.249393177.0000000005D9A000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.249167454.0000000005D99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comL.TTF
Source: Proforma Inv.exe, 00000000.00000003.249167454.0000000005D99000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.248778008.0000000005D98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: Proforma Inv.exe, 00000000.00000003.249167454.0000000005D99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comab
Source: Proforma Inv.exe, 00000000.00000003.249877134.0000000005D99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comalic#
Source: Proforma Inv.exe, 00000000.00000003.249877134.0000000005D99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comals
Source: Proforma Inv.exe, 00000000.00000003.249393177.0000000005D9A000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.249167454.0000000005D99000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.248778008.0000000005D98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comasvi
Source: Proforma Inv.exe, 00000000.00000003.249393177.0000000005D9A000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.249167454.0000000005D99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comcomF
Source: Proforma Inv.exe, 00000000.00000003.249167454.0000000005D99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comd
Source: Proforma Inv.exe, 00000000.00000003.249167454.0000000005D99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comion
Source: Proforma Inv.exe, 00000000.00000002.278940493.0000000005D90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comionFt
Source: Proforma Inv.exe, 00000000.00000003.249877134.0000000005D99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comitua
Source: Proforma Inv.exe, 00000000.00000003.249877134.0000000005D99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comt
Source: Proforma Inv.exe, 00000000.00000003.242844157.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242863799.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242891447.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: Proforma Inv.exe, 00000000.00000003.242844157.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242863799.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.comCH
Source: Proforma Inv.exe, 00000000.00000003.242919450.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242891447.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.comic
Source: Proforma Inv.exe, 00000000.00000003.242891447.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.comn
Source: Proforma Inv.exe, 00000000.00000003.242863799.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.comoth
Source: Proforma Inv.exe, 00000000.00000003.244788585.0000000005D94000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.246769169.0000000005D9D000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.244537632.0000000005D94000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.244899824.0000000005D9B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Proforma Inv.exe, 00000000.00000003.244788585.0000000005D94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/e(
Source: Proforma Inv.exe, 00000000.00000003.244517298.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnu-ru
Source: Proforma Inv.exe, 00000000.00000003.244788585.0000000005D94000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.244537632.0000000005D94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnudi
Source: Proforma Inv.exe, 00000000.00000003.244537632.0000000005D94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cny
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Proforma Inv.exe, 00000000.00000003.242844157.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242766852.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242698082.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242656361.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242798809.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242919450.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242863799.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242819494.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242891447.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242737289.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.comKfC
Source: Proforma Inv.exe, 00000000.00000003.242656361.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.comh
Source: Proforma Inv.exe, 00000000.00000003.242880391.0000000005DB4000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242844157.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242766852.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242698082.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242656361.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242798809.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242863799.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242819494.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.242737289.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.coms
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Proforma Inv.exe, 00000000.00000003.243905944.0000000005D96000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kre
Source: Proforma Inv.exe, 00000000.00000003.243905944.0000000005D96000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.krights
Source: Proforma Inv.exe, 00000000.00000003.243905944.0000000005D96000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.krnta~
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: Proforma Inv.exe, 00000000.00000003.243218227.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, Proforma Inv.exe, 00000000.00000003.243198712.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.comcom
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: Proforma Inv.exe, 00000000.00000003.249877134.0000000005D99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.de
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Proforma Inv.exe, 00000000.00000003.249877134.0000000005D99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deFv
Source: Proforma Inv.exe, 00000000.00000002.279381567.0000000006FA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Proforma Inv.exe, 00000002.00000002.510735000.0000000002E0F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: Proforma Inv.exe, 00000002.00000002.510096392.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: unknown DNS traffic detected: queries for: mail.safalaw.com.ph
Creates a DirectInput object (often for capturing keystrokes)
Source: Proforma Inv.exe, 00000000.00000002.265427255.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.Proforma Inv.exe.3dff630.2.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 2.0.Proforma Inv.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 2.0.Proforma Inv.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 2.0.Proforma Inv.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 2.0.Proforma Inv.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 2.0.Proforma Inv.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 2.2.Proforma Inv.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Proforma Inv.exe.3dff630.2.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
.NET source code contains very large array initializations
Source: 2.0.Proforma Inv.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007bA239DB3Au002d643Cu002d4CE8u002dBEC1u002dDF30B6E801BDu007d/u00326037609u002d1026u002d40FDu002d9ECDu002dF6CF19F76457.cs Large array initialization: .cctor: array initializer size 11621
Source: 2.0.Proforma Inv.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007bA239DB3Au002d643Cu002d4CE8u002dBEC1u002dDF30B6E801BDu007d/u00326037609u002d1026u002d40FDu002d9ECDu002dF6CF19F76457.cs Large array initialization: .cctor: array initializer size 11621
Source: 2.0.Proforma Inv.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007bA239DB3Au002d643Cu002d4CE8u002dBEC1u002dDF30B6E801BDu007d/u00326037609u002d1026u002d40FDu002d9ECDu002dF6CF19F76457.cs Large array initialization: .cctor: array initializer size 11621
Source: 2.0.Proforma Inv.exe.400000.6.unpack, u003cPrivateImplementationDetailsu003eu007bA239DB3Au002d643Cu002d4CE8u002dBEC1u002dDF30B6E801BDu007d/u00326037609u002d1026u002d40FDu002d9ECDu002dF6CF19F76457.cs Large array initialization: .cctor: array initializer size 11621
Source: 2.0.Proforma Inv.exe.400000.8.unpack, u003cPrivateImplementationDetailsu003eu007bA239DB3Au002d643Cu002d4CE8u002dBEC1u002dDF30B6E801BDu007d/u00326037609u002d1026u002d40FDu002d9ECDu002dF6CF19F76457.cs Large array initialization: .cctor: array initializer size 11621
Source: 2.2.Proforma Inv.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bA239DB3Au002d643Cu002d4CE8u002dBEC1u002dDF30B6E801BDu007d/u00326037609u002d1026u002d40FDu002d9ECDu002dF6CF19F76457.cs Large array initialization: .cctor: array initializer size 11621
.NET source code contains very large strings
Source: Proforma Inv.exe, Form1.cs Long String: Length: 22528
Source: 0.0.Proforma Inv.exe.960000.0.unpack, Form1.cs Long String: Length: 22528
Source: 0.2.Proforma Inv.exe.960000.0.unpack, Form1.cs Long String: Length: 22528
Source: 2.2.Proforma Inv.exe.680000.1.unpack, Form1.cs Long String: Length: 22528
Source: 2.0.Proforma Inv.exe.680000.9.unpack, Form1.cs Long String: Length: 22528
Source: 2.0.Proforma Inv.exe.680000.13.unpack, Form1.cs Long String: Length: 22528
Source: 2.0.Proforma Inv.exe.680000.7.unpack, Form1.cs Long String: Length: 22528
Source: 2.0.Proforma Inv.exe.680000.5.unpack, Form1.cs Long String: Length: 22528
Source: 2.0.Proforma Inv.exe.680000.11.unpack, Form1.cs Long String: Length: 22528
Source: 2.0.Proforma Inv.exe.680000.1.unpack, Form1.cs Long String: Length: 22528
Source: 2.0.Proforma Inv.exe.680000.0.unpack, Form1.cs Long String: Length: 22528
Source: 2.0.Proforma Inv.exe.680000.2.unpack, Form1.cs Long String: Length: 22528
Source: 2.0.Proforma Inv.exe.680000.3.unpack, Form1.cs Long String: Length: 22528
Uses 32bit PE files
Source: Proforma Inv.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 0.2.Proforma Inv.exe.3dff630.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 2.0.Proforma Inv.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 2.0.Proforma Inv.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 2.0.Proforma Inv.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 2.0.Proforma Inv.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 2.0.Proforma Inv.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 2.2.Proforma Inv.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Proforma Inv.exe.3dff630.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Detected potential crypto function
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0121C284 0_2_0121C284
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0121E521 0_2_0121E521
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0121E569 0_2_0121E569
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0121E578 0_2_0121E578
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC13C48 0_2_0CC13C48
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC16650 0_2_0CC16650
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC12858 0_2_0CC12858
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC1462A 0_2_0CC1462A
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC168A0 0_2_0CC168A0
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC168B0 0_2_0CC168B0
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC10040 0_2_0CC10040
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC12848 0_2_0CC12848
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC10007 0_2_0CC10007
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC16AB3 0_2_0CC16AB3
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC16B58 0_2_0CC16B58
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC16310 0_2_0CC16310
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC16B21 0_2_0CC16B21
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_00F9F080 2_2_00F9F080
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_00F96120 2_2_00F96120
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_00F9F3C8 2_2_00F9F3C8
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_0613C200 2_2_0613C200
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_0613EC08 2_2_0613EC08
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_0613D938 2_2_0613D938
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_06133330 2_2_06133330
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_0613CCD0 2_2_0613CCD0
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_06359451 2_2_06359451
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_0635E5B9 2_2_0635E5B9
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_06352DC0 2_2_06352DC0
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_063503D8 2_2_063503D8
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_06355868 2_2_06355868
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_0635CAA8 2_2_0635CAA8
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_06350374 2_2_06350374
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_06357BD8 2_2_06357BD8
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: String function: 06135E80 appears 35 times
Sample file is different than original file name gathered from version info
Source: Proforma Inv.exe Binary or memory string: OriginalFilename vs Proforma Inv.exe
Source: Proforma Inv.exe, 00000000.00000002.272478585.0000000003D09000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAxbFHqPWsbnQfPnkTjlnkheXJwv.exe4 vs Proforma Inv.exe
Source: Proforma Inv.exe, 00000000.00000002.279897380.0000000007620000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs Proforma Inv.exe
Source: Proforma Inv.exe, 00000000.00000002.266264478.0000000002D01000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs Proforma Inv.exe
Source: Proforma Inv.exe, 00000000.00000002.266264478.0000000002D01000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAxbFHqPWsbnQfPnkTjlnkheXJwv.exe4 vs Proforma Inv.exe
Source: Proforma Inv.exe, 00000000.00000002.270800937.00000000031C0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs Proforma Inv.exe
Source: Proforma Inv.exe, 00000000.00000002.265427255.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Proforma Inv.exe
Source: Proforma Inv.exe, 00000000.00000002.277363748.000000000419A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs Proforma Inv.exe
Source: Proforma Inv.exe Binary or memory string: OriginalFilename vs Proforma Inv.exe
Source: Proforma Inv.exe, 00000002.00000002.508474036.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAxbFHqPWsbnQfPnkTjlnkheXJwv.exe4 vs Proforma Inv.exe
Source: Proforma Inv.exe, 00000002.00000002.508977073.0000000000AF8000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Proforma Inv.exe
Source: Proforma Inv.exe Binary or memory string: OriginalFilenameHEhUz.exe8 vs Proforma Inv.exe
Source: Proforma Inv.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Proforma Inv.exe Virustotal: Detection: 33%
Source: Proforma Inv.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Proforma Inv.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Proforma Inv.exe "C:\Users\user\Desktop\Proforma Inv.exe"
Source: C:\Users\user\Desktop\Proforma Inv.exe Process created: C:\Users\user\Desktop\Proforma Inv.exe {path}
Source: C:\Users\user\Desktop\Proforma Inv.exe Process created: C:\Users\user\Desktop\Proforma Inv.exe {path} Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Proforma Inv.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Proforma Inv.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Proforma Inv.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/1@1/1
Source: C:\Users\user\Desktop\Proforma Inv.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: 2.0.Proforma Inv.exe.400000.12.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.Proforma Inv.exe.400000.12.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.Proforma Inv.exe.400000.10.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.Proforma Inv.exe.400000.10.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.Proforma Inv.exe.400000.4.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.Proforma Inv.exe.400000.4.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\Proforma Inv.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: Proforma Inv.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Proforma Inv.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: Proforma Inv.exe, Form1.cs .Net Code: PrivateSetup System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.Proforma Inv.exe.960000.0.unpack, Form1.cs .Net Code: PrivateSetup System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.Proforma Inv.exe.960000.0.unpack, Form1.cs .Net Code: PrivateSetup System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 2.2.Proforma Inv.exe.680000.1.unpack, Form1.cs .Net Code: PrivateSetup System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 2.0.Proforma Inv.exe.680000.9.unpack, Form1.cs .Net Code: PrivateSetup System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 2.0.Proforma Inv.exe.680000.13.unpack, Form1.cs .Net Code: PrivateSetup System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 2.0.Proforma Inv.exe.680000.7.unpack, Form1.cs .Net Code: PrivateSetup System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 2.0.Proforma Inv.exe.680000.5.unpack, Form1.cs .Net Code: PrivateSetup System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 2.0.Proforma Inv.exe.680000.11.unpack, Form1.cs .Net Code: PrivateSetup System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 2.0.Proforma Inv.exe.680000.1.unpack, Form1.cs .Net Code: PrivateSetup System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 2.0.Proforma Inv.exe.680000.0.unpack, Form1.cs .Net Code: PrivateSetup System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 2.0.Proforma Inv.exe.680000.2.unpack, Form1.cs .Net Code: PrivateSetup System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 2.0.Proforma Inv.exe.680000.3.unpack, Form1.cs .Net Code: PrivateSetup System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_00966A95 push es; retf 0_2_00966A96
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_00966A5E push es; retf 0_2_00966A60
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_00966A4D push es; retf 0_2_00966A4E
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_00966A70 push es; retf 0_2_00966A72
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC174E9 push eax; ret 0_2_0CC174EC
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC15E39 pushfd ; iretd 0_2_0CC15E3A
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 0_2_0CC11AE0 push esi; ret 0_2_0CC11AE2
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_00686A70 push es; retf 2_2_00686A72
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_00686A4D push es; retf 2_2_00686A4E
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_00686A5E push es; retf 2_2_00686A60
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_00686A95 push es; retf 2_2_00686A96
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_0613165E push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_06131662 push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_0613166A push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_0613169A push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_0613169E push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_061316B2 push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_061316B6 push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_061316BA push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_061316BE push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_061316A6 push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_061316AA push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_061316AE push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_061316D2 push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_061316D6 push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_061316DA push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_061316DE push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_061316C2 push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_061316C6 push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_061316CA push es; ret 2_2_061318C4
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_061316CE push es; ret 2_2_061318C4
Source: initial sample Static PE information: section name: .text entropy: 7.86044321518
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: Proforma Inv.exe PID: 6872, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Proforma Inv.exe, 00000000.00000002.269280530.0000000003037000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Proforma Inv.exe, 00000000.00000002.269280530.0000000003037000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Proforma Inv.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Proforma Inv.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Proforma Inv.exe TID: 6912 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe TID: 6232 Thread sleep time: -18446744073709540s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe TID: 6212 Thread sleep count: 4984 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe TID: 6212 Thread sleep count: 3588 > 30 Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Proforma Inv.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Proforma Inv.exe Window / User API: threadDelayed 4984 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Window / User API: threadDelayed 3588 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Proforma Inv.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Proforma Inv.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Proforma Inv.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Proforma Inv.exe, 00000000.00000002.269280530.0000000003037000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: Proforma Inv.exe, 00000000.00000002.269280530.0000000003037000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: Proforma Inv.exe, 00000000.00000002.269280530.0000000003037000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Proforma Inv.exe, 00000000.00000002.269280530.0000000003037000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Proforma Inv.exe, 00000000.00000002.269280530.0000000003037000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE
Source: Proforma Inv.exe, 00000000.00000002.269280530.0000000003037000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Proforma Inv.exe, 00000000.00000002.269280530.0000000003037000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Proforma Inv.exe, 00000000.00000002.269280530.0000000003037000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: Proforma Inv.exe, 00000000.00000002.269280530.0000000003037000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Enables debug privileges
Source: C:\Users\user\Desktop\Proforma Inv.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Proforma Inv.exe Code function: 2_2_0613BAE0 LdrInitializeThunk, 2_2_0613BAE0
Source: C:\Users\user\Desktop\Proforma Inv.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Proforma Inv.exe Memory written: C:\Users\user\Desktop\Proforma Inv.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Proforma Inv.exe Process created: C:\Users\user\Desktop\Proforma Inv.exe {path} Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Users\user\Desktop\Proforma Inv.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Users\user\Desktop\Proforma Inv.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.Proforma Inv.exe.3dff630.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.Proforma Inv.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.Proforma Inv.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.Proforma Inv.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.Proforma Inv.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.Proforma Inv.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.Proforma Inv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Inv.exe.3dff630.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.508474036.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.262797800.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.263643345.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.262428568.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.263201971.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.272478585.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.510096392.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Proforma Inv.exe PID: 6872, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Proforma Inv.exe PID: 7096, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\Proforma Inv.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\Proforma Inv.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\Proforma Inv.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\Proforma Inv.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Proforma Inv.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000002.00000002.510096392.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Proforma Inv.exe PID: 7096, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.Proforma Inv.exe.3dff630.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.Proforma Inv.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.Proforma Inv.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.Proforma Inv.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.Proforma Inv.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.Proforma Inv.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.Proforma Inv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Proforma Inv.exe.3dff630.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.508474036.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.262797800.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.263643345.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.262428568.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.263201971.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.272478585.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.510096392.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Proforma Inv.exe PID: 6872, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Proforma Inv.exe PID: 7096, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 605000 Sample: Proforma Inv.exe Startdate: 07/04/2022 Architecture: WINDOWS Score: 100 18 Found malware configuration 2->18 20 Malicious sample detected (through community Yara rule) 2->20 22 Multi AV Scanner detection for submitted file 2->22 24 9 other signatures 2->24 6 Proforma Inv.exe 3 2->6         started        process3 file4 14 C:\Users\user\...\Proforma Inv.exe.log, ASCII 6->14 dropped 26 Injects a PE file into a foreign processes 6->26 10 Proforma Inv.exe 2 6->10         started        signatures5 process6 dnsIp7 16 mail.safalaw.com.ph 207.148.117.199, 49756, 587 AS-CHOOPAUS United States 10->16 28 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->28 30 Tries to steal Mail credentials (via file / registry access) 10->30 32 Tries to harvest and steal ftp login credentials 10->32 34 Tries to harvest and steal browser information (history, passwords, etc) 10->34 signatures8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
207.148.117.199
 mail.safalaw.com.ph United States
20473 AS-CHOOPAUS true

Contacted Domains

Name IP Active
mail.safalaw.com.ph 207.148.117.199 true