Windows Analysis Report
Purchase order 450080088 proj. Allt Charnan.exe

Overview

General Information

Sample Name: Purchase order 450080088 proj. Allt Charnan.exe
Analysis ID: 626538
MD5: 152ef22896bf39197d210d40171e898a
SHA1: bdd88e03d9131d7f35e0bfadbed02010d231a1bd
SHA256: 5a3834895f08aff701a029275074d4ab47aff4951d6f75e8393b0a97cb8f6031
Tags: agentteslaexe
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Yara detected AntiVM3
Multi AV Scanner detection for dropped file
Tries to steal Mail credentials (via file / registry access)
Initial sample is a PE file and has a suspicious name
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
.NET source code references suspicious native API functions
Modifies the hosts file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
Machine Learning detection for dropped file
Adds a directory exclusion to Windows Defender
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
Creates processes with suspicious names
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Found malware configuration
Source: 29.0.jVULYR.exe.400000.4.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "aborderias@transmase.com", "Password": "pass@111", "Host": "smtp.transmase.com"}
Multi AV Scanner detection for submitted file
Source: Purchase order 450080088 proj. Allt Charnan.exe Virustotal: Detection: 37% Perma Link
Source: Purchase order 450080088 proj. Allt Charnan.exe ReversingLabs: Detection: 61%
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\NpPgfycY.exe ReversingLabs: Detection: 61%
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe ReversingLabs: Detection: 61%
Machine Learning detection for sample
Source: Purchase order 450080088 proj. Allt Charnan.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\NpPgfycY.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 29.0.jVULYR.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 25.2.jVULYR.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 9.2.Purchase order 450080088 proj. Allt Charnan.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 29.0.jVULYR.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8
Source: 29.2.jVULYR.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 25.0.jVULYR.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 25.0.jVULYR.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 25.0.jVULYR.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 25.0.jVULYR.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8
Source: 29.0.jVULYR.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 29.0.jVULYR.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8
Source: 29.0.jVULYR.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 25.0.jVULYR.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Uses 32bit PE files
Source: Purchase order 450080088 proj. Allt Charnan.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Source: Purchase order 450080088 proj. Allt Charnan.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: SZArrayEnumera.pdb source: jVULYR.exe, jVULYR.exe, 00000019.00000000.348771513.00000000009B2000.00000002.00000001.01000000.00000009.sdmp, jVULYR.exe, 0000001D.00000000.371444039.0000000000822000.00000002.00000001.01000000.00000009.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, jVULYR.exe.9.dr, NpPgfycY.exe.0.dr
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49747 -> 208.91.198.38:587
Source: global traffic TCP traffic: 192.168.2.3:49752 -> 162.222.225.16:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.3:49747 -> 208.91.198.38:587
Source: global traffic TCP traffic: 192.168.2.3:49752 -> 162.222.225.16:587
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000009.00000002.517206947.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 00000019.00000002.517627144.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 0000001D.00000002.518604895.0000000002E11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: jVULYR.exe, 0000001D.00000002.520269819.000000000316E000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 0000001D.00000003.480252697.0000000000D94000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://2FcFU77ZypH.org
Source: jVULYR.exe, 0000001D.00000002.518604895.0000000002E11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: jVULYR.exe, 0000001D.00000002.518604895.0000000002E11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://TwQUlE.com
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.244802747.0000000005E66000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://en.w
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.286211001.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 00000014.00000002.355635331.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 00000017.00000002.378427187.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000009.00000002.519099942.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000009.00000002.519288235.0000000002E45000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 00000019.00000002.520008150.00000000030D7000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 00000019.00000002.519797643.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 0000001D.00000002.520534688.000000000318E000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 0000001D.00000002.520325574.0000000003176000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://smtp.transmase.com
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000009.00000002.519099942.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000009.00000002.519288235.0000000002E45000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 00000019.00000002.520008150.00000000030D7000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 00000019.00000002.519797643.00000000030B7000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 0000001D.00000002.520534688.000000000318E000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 0000001D.00000002.520325574.0000000003176000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253513922.0000000005E67000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253746294.0000000005E68000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253513922.0000000005E67000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253746294.0000000005E68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com7
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253513922.0000000005E67000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253746294.0000000005E68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comF
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.284755099.0000000005E60000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.290951086.0000000005E60000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.259064063.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comaL
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253513922.0000000005E67000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253746294.0000000005E68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comalic
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253513922.0000000005E67000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253746294.0000000005E68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comals
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.259064063.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comceu
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253513922.0000000005E67000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253746294.0000000005E68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comcomd
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253513922.0000000005E67000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253746294.0000000005E68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comh
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.284755099.0000000005E60000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.290951086.0000000005E60000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.259064063.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comiona
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253513922.0000000005E67000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.253746294.0000000005E68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comituL
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.284755099.0000000005E60000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.290951086.0000000005E60000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.259064063.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.commS
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246623797.0000000005E68000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246680153.0000000005E67000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246509021.0000000005E67000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246509021.0000000005E67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn:
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246623797.0000000005E68000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnaiL
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246680153.0000000005E67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cne-d
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246623797.0000000005E68000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246680153.0000000005E67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cng
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246680153.0000000005E67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn~
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.255349808.0000000005E98000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.255002822.0000000005E98000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.254913650.0000000005E98000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.255131346.0000000005E98000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.255062247.0000000005E98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.248653593.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.248792641.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.248653593.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.248792641.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/E
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.248653593.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.248792641.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/S
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.248653593.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.248792641.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0-
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.248653593.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.248792641.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/h
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.248792641.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245457597.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245996490.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246121234.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245979867.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246836550.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246204069.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246070856.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245007021.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.244404121.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.247306277.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245690255.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.247535138.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.244343928.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.244364704.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246152019.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.247977281.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.244820676.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246915519.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245783482.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.247726544.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246035883.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245457597.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245996490.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246121234.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245979867.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246836550.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246204069.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246070856.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245007021.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.244404121.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.247306277.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245690255.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.247535138.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246152019.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.247977281.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.244820676.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246915519.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245783482.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.247726544.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246035883.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245665208.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246265302.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.come
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245457597.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245996490.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246121234.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245979867.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246836550.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246204069.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246070856.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245007021.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.244404121.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.247306277.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245690255.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.247535138.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246152019.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.247977281.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.244820676.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246915519.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245783482.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.247726544.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246035883.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.245665208.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000003.246265302.0000000005E7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.comt
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.291113070.00000000070F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000009.00000002.517206947.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 00000019.00000002.517627144.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 0000001D.00000002.518604895.0000000002E11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000009.00000002.517206947.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 00000019.00000002.517627144.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 0000001D.00000002.518604895.0000000002E11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org%appdata
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000009.00000002.517206947.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 00000019.00000002.517627144.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 0000001D.00000002.518604895.0000000002E11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: unknown DNS traffic detected: queries for: smtp.transmase.com

Spam, unwanted Advertisements and Ransom Demands
barindex
Modifies the hosts file
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 25.2.jVULYR.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 29.0.jVULYR.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 23.2.jVULYR.exe.3c2afb0.6.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 9.2.Purchase order 450080088 proj. Allt Charnan.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.419f2b0.8.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.3faafb0.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 23.2.jVULYR.exe.3d94e90.9.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 23.2.jVULYR.exe.3d94e90.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 29.0.jVULYR.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.3f6f990.7.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 23.2.jVULYR.exe.3e1f2b0.8.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 20.2.jVULYR.exe.3caafb0.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 25.0.jVULYR.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 25.0.jVULYR.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.3faafb0.6.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 20.2.jVULYR.exe.3e9f2b0.8.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 29.2.jVULYR.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.419f2b0.8.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 23.2.jVULYR.exe.3e1f2b0.8.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 20.2.jVULYR.exe.3c6f990.7.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 25.0.jVULYR.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 25.0.jVULYR.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 23.2.jVULYR.exe.3c2afb0.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 25.0.jVULYR.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 29.0.jVULYR.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 20.2.jVULYR.exe.3caafb0.6.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 29.0.jVULYR.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 20.2.jVULYR.exe.3e14e90.9.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 20.2.jVULYR.exe.3e14e90.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 29.0.jVULYR.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 20.2.jVULYR.exe.3e9f2b0.8.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.4114e90.9.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.4114e90.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 23.2.jVULYR.exe.3bef990.7.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Purchase order 450080088 proj. Allt Charnan.exe
.NET source code contains very large array initializations
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007b54531E20u002d7AC7u002d4E3Fu002dA3D6u002d2F253551ED56u007d/ED5B17C0u002dA6D7u002d428Du002d887Eu002dAAFCECD5D615.cs Large array initialization: .cctor: array initializer size 11617
Source: 9.2.Purchase order 450080088 proj. Allt Charnan.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b54531E20u002d7AC7u002d4E3Fu002dA3D6u002d2F253551ED56u007d/ED5B17C0u002dA6D7u002d428Du002d887Eu002dAAFCECD5D615.cs Large array initialization: .cctor: array initializer size 11617
Uses 32bit PE files
Source: Purchase order 450080088 proj. Allt Charnan.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Yara signature match
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 25.2.jVULYR.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 29.0.jVULYR.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 23.2.jVULYR.exe.3c2afb0.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 9.2.Purchase order 450080088 proj. Allt Charnan.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.419f2b0.8.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.3faafb0.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 23.2.jVULYR.exe.3d94e90.9.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 23.2.jVULYR.exe.3d94e90.9.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 29.0.jVULYR.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.3f6f990.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 23.2.jVULYR.exe.3e1f2b0.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 20.2.jVULYR.exe.3caafb0.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 25.0.jVULYR.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 25.0.jVULYR.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.3faafb0.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 20.2.jVULYR.exe.3e9f2b0.8.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 29.2.jVULYR.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.419f2b0.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 23.2.jVULYR.exe.3e1f2b0.8.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 20.2.jVULYR.exe.3c6f990.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 25.0.jVULYR.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 25.0.jVULYR.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 23.2.jVULYR.exe.3c2afb0.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 25.0.jVULYR.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 29.0.jVULYR.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 20.2.jVULYR.exe.3caafb0.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 29.0.jVULYR.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 20.2.jVULYR.exe.3e14e90.9.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 20.2.jVULYR.exe.3e14e90.9.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 29.0.jVULYR.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 20.2.jVULYR.exe.3e9f2b0.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.4114e90.9.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.4114e90.9.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 23.2.jVULYR.exe.3bef990.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Detected potential crypto function
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 0_2_02D44358 0_2_02D44358
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 0_2_02D4BC20 0_2_02D4BC20
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 0_2_02D44348 0_2_02D44348
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 0_2_02D440B8 0_2_02D440B8
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 0_2_02D440A9 0_2_02D440A9
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 0_2_07AAB338 0_2_07AAB338
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 0_2_07AA2C3F 0_2_07AA2C3F
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 0_2_07AA1900 0_2_07AA1900
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 0_2_07AA1910 0_2_07AA1910
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_00FCF080 9_2_00FCF080
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_00FCF3C8 9_2_00FCF3C8
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_00FC6120 9_2_00FC6120
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_05BFCCF8 9_2_05BFCCF8
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_05BFBF98 9_2_05BFBF98
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_05BF9AE0 9_2_05BF9AE0
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_05BF1FF8 9_2_05BF1FF8
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_05BFB1C2 9_2_05BFB1C2
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_05BF0040 9_2_05BF0040
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B9F88 9_2_064B9F88
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B8520 9_2_064B8520
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B3330 9_2_064B3330
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 20_2_01274358 20_2_01274358
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 20_2_0127BC20 20_2_0127BC20
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 20_2_012740A9 20_2_012740A9
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 20_2_012740B8 20_2_012740B8
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 20_2_01274348 20_2_01274348
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 20_2_08CD9E40 20_2_08CD9E40
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 20_2_08CD15F7 20_2_08CD15F7
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 20_2_08CD02C8 20_2_08CD02C8
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 20_2_08CD02B8 20_2_08CD02B8
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 23_2_011A4358 23_2_011A4358
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 23_2_011ABC20 23_2_011ABC20
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 23_2_011A40B8 23_2_011A40B8
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 23_2_011A40A9 23_2_011A40A9
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 23_2_011A4348 23_2_011A4348
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 23_2_08D59E40 23_2_08D59E40
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 23_2_08D502C8 23_2_08D502C8
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 23_2_08D502B8 23_2_08D502B8
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 23_2_08D515F7 23_2_08D515F7
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_02C0F380 25_2_02C0F380
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_02C0F6C8 25_2_02C0F6C8
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_02C06560 25_2_02C06560
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_02C0CBE4 25_2_02C0CBE4
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_05792120 25_2_05792120
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_0579F86B 25_2_0579F86B
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_05790040 25_2_05790040
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_0579C820 25_2_0579C820
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_0579BAD0 25_2_0579BAD0
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_06348B77 25_2_06348B77
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_0634DB40 25_2_0634DB40
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_06342FC0 25_2_06342FC0
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_0634586D 25_2_0634586D
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_06342E70 25_2_06342E70
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_06340A40 25_2_06340A40
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_06343FB0 25_2_06343FB0
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_0634B158 25_2_0634B158
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: String function: 05BF5A68 appears 54 times
Sample file is different than original file name gathered from version info
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.289167000.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameOaCZByYRZIaXaKflASJVDoK.exe4 vs Purchase order 450080088 proj. Allt Charnan.exe
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000000.239580570.0000000000BD8000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSZArrayEnumera.exe6 vs Purchase order 450080088 proj. Allt Charnan.exe
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.293254846.0000000007A00000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameDotNetZipAdditionalPlatforms.dllZ vs Purchase order 450080088 proj. Allt Charnan.exe
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.289411327.0000000004092000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDotNetZipAdditionalPlatforms.dllZ vs Purchase order 450080088 proj. Allt Charnan.exe
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.289411327.0000000004092000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameOaCZByYRZIaXaKflASJVDoK.exe4 vs Purchase order 450080088 proj. Allt Charnan.exe
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.286211001.0000000002E71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameOaCZByYRZIaXaKflASJVDoK.exe4 vs Purchase order 450080088 proj. Allt Charnan.exe
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000008.00000000.278239975.0000000000378000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSZArrayEnumera.exe6 vs Purchase order 450080088 proj. Allt Charnan.exe
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000009.00000000.279735908.00000000007B8000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSZArrayEnumera.exe6 vs Purchase order 450080088 proj. Allt Charnan.exe
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000009.00000002.510429258.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenameOaCZByYRZIaXaKflASJVDoK.exe4 vs Purchase order 450080088 proj. Allt Charnan.exe
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000009.00000002.512965723.0000000000B58000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Purchase order 450080088 proj. Allt Charnan.exe
Source: Purchase order 450080088 proj. Allt Charnan.exe Binary or memory string: OriginalFilenameSZArrayEnumera.exe6 vs Purchase order 450080088 proj. Allt Charnan.exe
Source: Purchase order 450080088 proj. Allt Charnan.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: NpPgfycY.exe.0.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: jVULYR.exe.9.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Purchase order 450080088 proj. Allt Charnan.exe Virustotal: Detection: 37%
Source: Purchase order 450080088 proj. Allt Charnan.exe ReversingLabs: Detection: 61%
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File read: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Jump to behavior
Source: Purchase order 450080088 proj. Allt Charnan.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe "C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe"
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\NpPgfycY.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NpPgfycY" /XML "C:\Users\user\AppData\Local\Temp\tmp86F3.tmp
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process created: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process created: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe "C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe"
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NpPgfycY" /XML "C:\Users\user\AppData\Local\Temp\tmpFBF4.tmp
Source: unknown Process created: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe "C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process created: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NpPgfycY" /XML "C:\Users\user\AppData\Local\Temp\tmp2B32.tmp
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process created: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\NpPgfycY.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NpPgfycY" /XML "C:\Users\user\AppData\Local\Temp\tmp86F3.tmp Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process created: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process created: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NpPgfycY" /XML "C:\Users\user\AppData\Local\Temp\tmpFBF4.tmp
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process created: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NpPgfycY" /XML "C:\Users\user\AppData\Local\Temp\tmp2B32.tmp
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process created: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File created: C:\Users\user\AppData\Roaming\NpPgfycY.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File created: C:\Users\user\AppData\Local\Temp\tmp86F3.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.adwa.spyw.evad.winEXE@23/16@12/3
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6956:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7064:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1260:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7132:120:WilError_01
Source: Purchase order 450080088 proj. Allt Charnan.exe, Ej/rT.cs Cryptographic APIs: 'CreateDecryptor'
Source: Purchase order 450080088 proj. Allt Charnan.exe, Ej/rT.cs Cryptographic APIs: 'CreateDecryptor'
Source: NpPgfycY.exe.0.dr, Ej/rT.cs Cryptographic APIs: 'CreateDecryptor'
Source: NpPgfycY.exe.0.dr, Ej/rT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.b30000.0.unpack, Ej/rT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.b30000.0.unpack, Ej/rT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.Purchase order 450080088 proj. Allt Charnan.exe.b30000.0.unpack, Ej/rT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.Purchase order 450080088 proj. Allt Charnan.exe.b30000.0.unpack, Ej/rT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 8.0.Purchase order 450080088 proj. Allt Charnan.exe.2d0000.2.unpack, Ej/rT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 8.0.Purchase order 450080088 proj. Allt Charnan.exe.2d0000.2.unpack, Ej/rT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 8.0.Purchase order 450080088 proj. Allt Charnan.exe.2d0000.1.unpack, Ej/rT.cs Cryptographic APIs: 'CreateDecryptor'
Source: 8.0.Purchase order 450080088 proj. Allt Charnan.exe.2d0000.1.unpack, Ej/rT.cs Cryptographic APIs: 'CreateDecryptor'
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: Purchase order 450080088 proj. Allt Charnan.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Purchase order 450080088 proj. Allt Charnan.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Purchase order 450080088 proj. Allt Charnan.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: SZArrayEnumera.pdb source: jVULYR.exe, jVULYR.exe, 00000019.00000000.348771513.00000000009B2000.00000002.00000001.01000000.00000009.sdmp, jVULYR.exe, 0000001D.00000000.371444039.0000000000822000.00000002.00000001.01000000.00000009.sdmp, Purchase order 450080088 proj. Allt Charnan.exe, jVULYR.exe.9.dr, NpPgfycY.exe.0.dr

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: NpPgfycY.exe.0.dr, Ej/rT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.b30000.0.unpack, Ej/rT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 8.0.Purchase order 450080088 proj. Allt Charnan.exe.2d0000.2.unpack, Ej/rT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 8.0.Purchase order 450080088 proj. Allt Charnan.exe.2d0000.1.unpack, Ej/rT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 8.0.Purchase order 450080088 proj. Allt Charnan.exe.2d0000.3.unpack, Ej/rT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 8.0.Purchase order 450080088 proj. Allt Charnan.exe.2d0000.0.unpack, Ej/rT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 8.2.Purchase order 450080088 proj. Allt Charnan.exe.2d0000.0.unpack, Ej/rT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: jVULYR.exe.9.dr, Ej/rT.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 0_2_02D48DEE pushad ; retf 0_2_02D48DEF
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 0_2_02D490DC pushad ; retf 0_2_02D490DD
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 0_2_07AA65E5 push edi; retf 0_2_07AA65E6
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 0_2_07AA4AD5 push edx; iretd 0_2_07AA4AD6
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_00FC2F10 push ss; retf 9_2_00FC2F3D
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B9A25 push ss; retf 9_2_064B9A27
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B072C push 0000001Ah; retf 9_2_064B072E
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B3330 push es; iretd 9_2_064B41D0
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B3330 push es; iretd 9_2_064B41E0
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B2C74 push 0000001Ah; retf 9_2_064B2C76
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064BDCE5 push 0000001Ah; retf 9_2_064BDCE7
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B18F6 push es; ret 9_2_064B1910
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B18AA push es; ret 9_2_064B18C4
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B18BD push es; ret 9_2_064B18C4
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B2177 push edi; retn 0000h 9_2_064B2179
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B1909 push es; ret 9_2_064B1910
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B41D9 push es; iretd 9_2_064B41E0
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B41D1 push es; iretd 9_2_064B41D8
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Code function: 9_2_064B15F7 push 0000001Ah; retf 9_2_064B15F9
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 20_2_01278DEE pushad ; retf 20_2_01278DEF
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 20_2_012790DC pushad ; retf 20_2_012790DD
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 20_2_05183F76 push edi; iretd 20_2_05183F77
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 20_2_08CD348D push edx; iretd 20_2_08CD348E
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 23_2_011AA64B pushad ; retf 23_2_011AA64C
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 23_2_011A8DEE pushad ; retf 23_2_011A8DEF
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 23_2_011A90DC pushad ; retf 23_2_011A90DD
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 23_2_011A981A pushfd ; iretd 23_2_011A981E
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 23_2_08D5348D push edx; iretd 23_2_08D5348E
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_05799990 push 0000001Ah; retf 25_2_05799992
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_0579985B push 0000001Ah; retf 25_2_05799866
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_06344B0B push ss; retf 25_2_06344B0D
Source: initial sample Static PE information: section name: .text entropy: 7.75961172037
Source: initial sample Static PE information: section name: .text entropy: 7.75961172037
Source: initial sample Static PE information: section name: .text entropy: 7.75961172037
Creates processes with suspicious names
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File created: \purchase order 450080088 proj. allt charnan.exe
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File created: \purchase order 450080088 proj. allt charnan.exe
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File created: \purchase order 450080088 proj. allt charnan.exe
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File created: \purchase order 450080088 proj. allt charnan.exe
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File created: \purchase order 450080088 proj. allt charnan.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File created: \purchase order 450080088 proj. allt charnan.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File created: \purchase order 450080088 proj. allt charnan.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File created: \purchase order 450080088 proj. allt charnan.exe Jump to behavior
Drops PE files
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File created: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File created: C:\Users\user\AppData\Roaming\NpPgfycY.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NpPgfycY" /XML "C:\Users\user\AppData\Local\Temp\tmp86F3.tmp
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run jVULYR Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run jVULYR Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File opened: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 00000014.00000002.355635331.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.378427187.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.286211001.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Purchase order 450080088 proj. Allt Charnan.exe PID: 6588, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jVULYR.exe PID: 7076, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jVULYR.exe PID: 7100, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.286211001.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 00000014.00000002.355635331.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 00000017.00000002.378427187.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: Purchase order 450080088 proj. Allt Charnan.exe, 00000000.00000002.286211001.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 00000014.00000002.355635331.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, jVULYR.exe, 00000017.00000002.378427187.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe TID: 6592 Thread sleep time: -45733s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe TID: 6608 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7104 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe TID: 2376 Thread sleep time: -12912720851596678s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe TID: 3436 Thread sleep count: 4140 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe TID: 3436 Thread sleep count: 4455 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe TID: 7088 Thread sleep time: -45733s >= -30000s
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe TID: 2400 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe TID: 7016 Thread sleep time: -45733s >= -30000s
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe TID: 7036 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe TID: 872 Thread sleep time: -15679732462653109s >= -30000s
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe TID: 2920 Thread sleep count: 3147 > 30
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe TID: 872 Thread sleep time: -59500s >= -30000s
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe TID: 2920 Thread sleep count: 4125 > 30
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe TID: 872 Thread sleep time: -52688s >= -30000s
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe TID: 872 Thread sleep time: -48376s >= -30000s
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe TID: 872 Thread sleep time: -44594s >= -30000s
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe TID: 872 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe TID: 5660 Thread sleep time: -11990383647911201s >= -30000s
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe TID: 5664 Thread sleep count: 4186 > 30
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe TID: 7104 Thread sleep count: 2293 > 30
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6818 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1776 Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Window / User API: threadDelayed 4140 Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Window / User API: threadDelayed 4455 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Window / User API: threadDelayed 3147
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Window / User API: threadDelayed 4125
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Window / User API: threadDelayed 4186
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Window / User API: threadDelayed 2293
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Thread delayed: delay time: 45733 Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Thread delayed: delay time: 45733
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Thread delayed: delay time: 45733
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Thread delayed: delay time: 922337203685477
Source: jVULYR.exe, 00000017.00000002.378427187.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: jVULYR.exe, 00000017.00000002.378427187.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: jVULYR.exe, 00000017.00000002.378427187.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: jVULYR.exe, 00000017.00000002.378427187.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Enables debug privileges
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Code function: 25_2_0634CEB0 LdrInitializeThunk, 25_2_0634CEB0
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: Purchase order 450080088 proj. Allt Charnan.exe, Ej/rT.cs Reference to suspicious API methods: ('WJJ', 'LoadLibrary@kernel32'), ('QJy', 'GetProcAddress@kernel32')
Source: NpPgfycY.exe.0.dr, Ej/rT.cs Reference to suspicious API methods: ('WJJ', 'LoadLibrary@kernel32'), ('QJy', 'GetProcAddress@kernel32')
Source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.b30000.0.unpack, Ej/rT.cs Reference to suspicious API methods: ('WJJ', 'LoadLibrary@kernel32'), ('QJy', 'GetProcAddress@kernel32')
Source: 0.0.Purchase order 450080088 proj. Allt Charnan.exe.b30000.0.unpack, Ej/rT.cs Reference to suspicious API methods: ('WJJ', 'LoadLibrary@kernel32'), ('QJy', 'GetProcAddress@kernel32')
Source: 8.0.Purchase order 450080088 proj. Allt Charnan.exe.2d0000.2.unpack, Ej/rT.cs Reference to suspicious API methods: ('WJJ', 'LoadLibrary@kernel32'), ('QJy', 'GetProcAddress@kernel32')
Source: 8.0.Purchase order 450080088 proj. Allt Charnan.exe.2d0000.1.unpack, Ej/rT.cs Reference to suspicious API methods: ('WJJ', 'LoadLibrary@kernel32'), ('QJy', 'GetProcAddress@kernel32')
Source: 8.0.Purchase order 450080088 proj. Allt Charnan.exe.2d0000.3.unpack, Ej/rT.cs Reference to suspicious API methods: ('WJJ', 'LoadLibrary@kernel32'), ('QJy', 'GetProcAddress@kernel32')
Source: 8.0.Purchase order 450080088 proj. Allt Charnan.exe.2d0000.0.unpack, Ej/rT.cs Reference to suspicious API methods: ('WJJ', 'LoadLibrary@kernel32'), ('QJy', 'GetProcAddress@kernel32')
Source: 8.2.Purchase order 450080088 proj. Allt Charnan.exe.2d0000.0.unpack, Ej/rT.cs Reference to suspicious API methods: ('WJJ', 'LoadLibrary@kernel32'), ('QJy', 'GetProcAddress@kernel32')
Source: jVULYR.exe.9.dr, Ej/rT.cs Reference to suspicious API methods: ('WJJ', 'LoadLibrary@kernel32'), ('QJy', 'GetProcAddress@kernel32')
Source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.4.unpack, A/E1.cs Reference to suspicious API methods: ('A', 'MapVirtualKey@user32.dll')
Source: 9.2.Purchase order 450080088 proj. Allt Charnan.exe.400000.0.unpack, A/E1.cs Reference to suspicious API methods: ('A', 'MapVirtualKey@user32.dll')
Modifies the hosts file
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\NpPgfycY.exe
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\NpPgfycY.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\NpPgfycY.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NpPgfycY" /XML "C:\Users\user\AppData\Local\Temp\tmp86F3.tmp Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process created: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Process created: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NpPgfycY" /XML "C:\Users\user\AppData\Local\Temp\tmpFBF4.tmp
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process created: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NpPgfycY" /XML "C:\Users\user\AppData\Local\Temp\tmp2B32.tmp
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Process created: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Modifies the hosts file
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.jVULYR.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.jVULYR.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.jVULYR.exe.3c2afb0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Purchase order 450080088 proj. Allt Charnan.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.419f2b0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.3faafb0.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.jVULYR.exe.3d94e90.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.jVULYR.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.3f6f990.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.jVULYR.exe.3e1f2b0.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.jVULYR.exe.3caafb0.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.0.jVULYR.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.0.jVULYR.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.3faafb0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.jVULYR.exe.3e9f2b0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.jVULYR.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.419f2b0.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.jVULYR.exe.3e1f2b0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.jVULYR.exe.3c6f990.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.0.jVULYR.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.0.jVULYR.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.jVULYR.exe.3c2afb0.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.0.jVULYR.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.jVULYR.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.jVULYR.exe.3caafb0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.jVULYR.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.jVULYR.exe.3e14e90.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.jVULYR.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.jVULYR.exe.3e9f2b0.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.4114e90.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.jVULYR.exe.3bef990.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.289167000.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000000.352037043.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.372079781.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.371351565.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.359292860.0000000003D92000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.393985190.0000000003BEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.510450291.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.510451079.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.510429258.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.373291571.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.283648504.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.372700308.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000000.351287356.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.283045537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.395811711.0000000003D12000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.282465833.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.358279749.0000000003C6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000000.350592858.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000000.349995219.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.289411327.0000000004092000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.281949577.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.517627144.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.517206947.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.518604895.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Purchase order 450080088 proj. Allt Charnan.exe PID: 6588, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Purchase order 450080088 proj. Allt Charnan.exe PID: 7124, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jVULYR.exe PID: 7076, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jVULYR.exe PID: 7100, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jVULYR.exe PID: 6676, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jVULYR.exe PID: 5908, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\Purchase order 450080088 proj. Allt Charnan.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\AppData\Roaming\jVULYR\jVULYR.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Yara detected Credential Stealer
Source: Yara match File source: 00000019.00000002.517627144.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.517206947.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.518604895.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Purchase order 450080088 proj. Allt Charnan.exe PID: 7124, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jVULYR.exe PID: 6676, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jVULYR.exe PID: 5908, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.jVULYR.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.jVULYR.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.jVULYR.exe.3c2afb0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Purchase order 450080088 proj. Allt Charnan.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.419f2b0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.3faafb0.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.jVULYR.exe.3d94e90.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.jVULYR.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.3f6f990.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.jVULYR.exe.3e1f2b0.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.jVULYR.exe.3caafb0.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.0.jVULYR.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.0.jVULYR.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.3faafb0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.jVULYR.exe.3e9f2b0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.jVULYR.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.419f2b0.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.Purchase order 450080088 proj. Allt Charnan.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.jVULYR.exe.3e1f2b0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.jVULYR.exe.3c6f990.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.0.jVULYR.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.0.jVULYR.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.jVULYR.exe.3c2afb0.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.0.jVULYR.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.jVULYR.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.jVULYR.exe.3caafb0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.jVULYR.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.jVULYR.exe.3e14e90.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.0.jVULYR.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.jVULYR.exe.3e9f2b0.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase order 450080088 proj. Allt Charnan.exe.4114e90.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 23.2.jVULYR.exe.3bef990.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.289167000.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000000.352037043.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.372079781.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.371351565.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.359292860.0000000003D92000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.393985190.0000000003BEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.510450291.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.510451079.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.510429258.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.373291571.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.283648504.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.372700308.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000000.351287356.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.283045537.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.395811711.0000000003D12000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.282465833.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.358279749.0000000003C6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000000.350592858.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000000.349995219.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.289411327.0000000004092000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.281949577.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.517627144.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.517206947.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.518604895.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Purchase order 450080088 proj. Allt Charnan.exe PID: 6588, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Purchase order 450080088 proj. Allt Charnan.exe PID: 7124, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jVULYR.exe PID: 7076, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jVULYR.exe PID: 7100, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jVULYR.exe PID: 6676, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: jVULYR.exe PID: 5908, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 626538 Sample: Purchase order 450080088 pr... Startdate: 14/05/2022 Architecture: WINDOWS Score: 100 67 us2.smtp.mailhostbox.com 2->67 69 smtp.transmase.com 2->69 83 Found malware configuration 2->83 85 Malicious sample detected (through community Yara rule) 2->85 87 Multi AV Scanner detection for dropped file 2->87 89 14 other signatures 2->89 8 Purchase order 450080088 proj. Allt Charnan.exe 7 2->8         started        12 jVULYR.exe 2->12         started        14 jVULYR.exe 2->14         started        signatures3 process4 file5 49 C:\Users\user\AppData\Roaming49pPgfycY.exe, PE32 8->49 dropped 51 C:\Users\...51pPgfycY.exe:Zone.Identifier, ASCII 8->51 dropped 53 C:\Users\user\AppData\Local\...\tmp86F3.tmp, XML 8->53 dropped 55 Purchase order 450...llt Charnan.exe.log, ASCII 8->55 dropped 91 Adds a directory exclusion to Windows Defender 8->91 16 Purchase order 450080088 proj. Allt Charnan.exe 2 9 8->16         started        21 powershell.exe 25 8->21         started        23 schtasks.exe 1 8->23         started        25 Purchase order 450080088 proj. Allt Charnan.exe 8->25         started        93 Multi AV Scanner detection for dropped file 12->93 95 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->95 97 Machine Learning detection for dropped file 12->97 99 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 12->99 27 jVULYR.exe 12->27         started        29 schtasks.exe 12->29         started        31 jVULYR.exe 14->31         started        33 schtasks.exe 14->33         started        signatures6 process7 dnsIp8 57 162.222.225.16, 49752, 587 PUBLIC-DOMAIN-REGISTRYUS United States 16->57 59 us2.smtp.mailhostbox.com 208.91.198.38, 49747, 49823, 49837 PUBLIC-DOMAIN-REGISTRYUS United States 16->59 65 2 other IPs or domains 16->65 43 C:\Users\user\AppData\Roaming\...\jVULYR.exe, PE32 16->43 dropped 45 C:\Windows\System32\drivers\etc\hosts, ASCII 16->45 dropped 47 C:\Users\user\...\jVULYR.exe:Zone.Identifier, ASCII 16->47 dropped 71 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->71 73 Tries to steal Mail credentials (via file / registry access) 16->73 75 Modifies the hosts file 16->75 77 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->77 35 conhost.exe 21->35         started        37 conhost.exe 23->37         started        61 smtp.transmase.com 27->61 39 conhost.exe 29->39         started        63 smtp.transmase.com 31->63 79 Tries to harvest and steal ftp login credentials 31->79 81 Tries to harvest and steal browser information (history, passwords, etc) 31->81 41 conhost.exe 33->41         started        file9 signatures10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.222.225.16
 unknown United States
394695 PUBLIC-DOMAIN-REGISTRYUS false
208.91.198.38
 us2.smtp.mailhostbox.com United States
394695 PUBLIC-DOMAIN-REGISTRYUS false

Private

IP
192.168.2.1

Contacted Domains

Name IP Active
us2.smtp.mailhostbox.com 208.91.198.38 true
smtp.transmase.com unknown unknown