Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report SOA & Invoices 440086.exe

Overview

General Information

Sample Name:SOA & Invoices 440086.exe
Analysis ID:432713
MD5:a5247d790d44aec18f5ec3e4ea037685
SHA1:26633a91c4ac686a0f26a47444fa4c15798d1d2b
SHA256:adefb18837fffc19e4477292c47b9b85d92b1fc3385b66f1a921dd84bf8a2eea
Tags:exe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains functionality to detect virtual machines (SGDT)
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Non Interactive PowerShell
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • SOA & Invoices 440086.exe (PID: 6412 cmdline: 'C:\Users\user\Desktop\SOA & Invoices 440086.exe' MD5: A5247D790D44AEC18F5EC3E4EA037685)
    • powershell.exe (PID: 6564 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SOA & Invoices 440086.exe' MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 6636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • SOA & Invoices 440086.exe (PID: 6668 cmdline: C:\Users\user\Desktop\SOA & Invoices 440086.exe MD5: A5247D790D44AEC18F5EC3E4EA037685)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "framafilmsint@framafilms.comlister11mail.framafilms.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.496465103.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000005.00000002.496465103.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        00000005.00000000.257856351.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000005.00000000.257856351.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
            Click to see the 8 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.SOA & Invoices 440086.exe.3d3c548.2.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              1.2.SOA & Invoices 440086.exe.3d3c548.2.raw.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                5.0.SOA & Invoices 440086.exe.400000.1.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  5.0.SOA & Invoices 440086.exe.400000.1.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    1.2.SOA & Invoices 440086.exe.3e591c8.1.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 5 entries

                      Sigma Overview

                      System Summary:

                      barindex
                      Sigma detected: Non Interactive PowerShellShow sources
                      Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SOA & Invoices 440086.exe', CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SOA & Invoices 440086.exe', CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Users\user\Desktop\SOA & Invoices 440086.exe' , ParentImage: C:\Users\user\Desktop\SOA & Invoices 440086.exe, ParentProcessId: 6412, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SOA & Invoices 440086.exe', ProcessId: 6564

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmpMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "framafilmsint@framafilms.comlister11mail.framafilms.com"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: SOA & Invoices 440086.exeVirustotal: Detection: 25%Perma Link
                      Source: SOA & Invoices 440086.exeReversingLabs: Detection: 17%
                      Machine Learning detection for sampleShow sources
                      Source: SOA & Invoices 440086.exeJoe Sandbox ML: detected
                      Source: 5.2.SOA & Invoices 440086.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 5.0.SOA & Invoices 440086.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                      Source: SOA & Invoices 440086.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: SOA & Invoices 440086.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\cjdyqHVUBe\src\obj\x86\Debug\OverideEventProvider.pdb source: SOA & Invoices 440086.exe
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                      Source: global trafficTCP traffic: 192.168.2.7:49752 -> 185.220.245.14:587
                      Source: Joe Sandbox ViewIP Address: 185.220.245.14 185.220.245.14
                      Source: Joe Sandbox ViewASN Name: SEEWEBWebhostingcolocationandcloudservicesIT SEEWEBWebhostingcolocationandcloudservicesIT
                      Source: global trafficTCP traffic: 192.168.2.7:49752 -> 185.220.245.14:587
                      Source: unknownDNS traffic detected: queries for: mail.framafilms.com
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: powershell.exe, 00000002.00000002.334306664.0000000000A37000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.508196648.0000000002DC1000.00000004.00000001.sdmpString found in binary or memory: http://mail.framafilms.com
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260304981.0000000002C51000.00000004.00000001.sdmp, powershell.exe, 00000002.00000002.335650610.0000000004591000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmpString found in binary or memory: http://xDvmSt.com
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%$
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.507912865.0000000002D72000.00000004.00000001.sdmp, SOA & Invoices 440086.exe, 00000005.00000003.484944761.0000000000E04000.00000004.00000001.sdmpString found in binary or memory: https://pU6NdWQcDtRIHGBxR.com
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.262852424.0000000003C59000.00000004.00000001.sdmp, SOA & Invoices 440086.exe, 00000005.00000002.496465103.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.259550635.0000000000D58000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 5.2.SOA & Invoices 440086.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b12FF4530u002dFEC9u002d460Fu002dBB79u002d2D52E17190A6u007d/u0038695B17Bu002d0BD1u002d49D5u002dB560u002dF76DA5ECA03B.csLarge array initialization: .cctor: array initializer size 11960
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: SOA & Invoices 440086.exe
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 1_2_0067A90E
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 1_2_006763D5
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 1_2_00FCC2B0
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 1_2_00FC9970
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 1_2_01101418
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 1_2_01103400
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 1_2_01105745
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 1_2_01107B18
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 1_2_01101CE8
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 1_2_011010D0
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 1_2_01105340
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 1_2_01109290
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_07806620
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0780E664
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_078055A8
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_078055B8
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0780F407
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_078146E8
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_078162A8
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 5_2_0073A90E
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 5_2_007363D5
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 5_2_00F546A0
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 5_2_00F54618
                      Source: SOA & Invoices 440086.exe, 00000001.00000003.242268248.0000000003F68000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDSASignature.dll@ vs SOA & Invoices 440086.exe
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.273926353.000000000E630000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs SOA & Invoices 440086.exe
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.272819367.0000000008870000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs SOA & Invoices 440086.exe
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260304981.0000000002C51000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNFdPzhEyLJjKbrEDZupXKhqNAcmKaqwKUmvRjKF.exe4 vs SOA & Invoices 440086.exe
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.259021649.0000000000766000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameOverideEventProvider.exeZ vs SOA & Invoices 440086.exe
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.262852424.0000000003C59000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameKygo.dll* vs SOA & Invoices 440086.exe
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.274761434.000000000E720000.00000002.00000001.sdmpBinary or memory string: originalfilename vs SOA & Invoices 440086.exe
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.274761434.000000000E720000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs SOA & Invoices 440086.exe
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.511084175.00000000061D0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs SOA & Invoices 440086.exe
                      Source: SOA & Invoices 440086.exe, 00000005.00000000.257551212.0000000000826000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameOverideEventProvider.exeZ vs SOA & Invoices 440086.exe
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.496465103.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameNFdPzhEyLJjKbrEDZupXKhqNAcmKaqwKUmvRjKF.exe4 vs SOA & Invoices 440086.exe
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.501518547.0000000000FEA000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs SOA & Invoices 440086.exe
                      Source: SOA & Invoices 440086.exeBinary or memory string: OriginalFilenameOverideEventProvider.exeZ vs SOA & Invoices 440086.exe
                      Source: SOA & Invoices 440086.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: SOA & Invoices 440086.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: 5.2.SOA & Invoices 440086.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 5.2.SOA & Invoices 440086.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@6/5@1/1
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SOA & Invoices 440086.exe.logJump to behavior
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6636:120:WilError_01
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xul1hgna.ujz.ps1Jump to behavior
                      Source: SOA & Invoices 440086.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: Select * from Clientes WHERE id=@id;;
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE id=@id;
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
                      Source: SOA & Invoices 440086.exeVirustotal: Detection: 25%
                      Source: SOA & Invoices 440086.exeReversingLabs: Detection: 17%
                      Source: unknownProcess created: C:\Users\user\Desktop\SOA & Invoices 440086.exe 'C:\Users\user\Desktop\SOA & Invoices 440086.exe'
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SOA & Invoices 440086.exe'
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess created: C:\Users\user\Desktop\SOA & Invoices 440086.exe C:\Users\user\Desktop\SOA & Invoices 440086.exe
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SOA & Invoices 440086.exe'
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess created: C:\Users\user\Desktop\SOA & Invoices 440086.exe C:\Users\user\Desktop\SOA & Invoices 440086.exe
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
                      Source: Window RecorderWindow detected: More than 3 window changes detected
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                      Source: SOA & Invoices 440086.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: SOA & Invoices 440086.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: SOA & Invoices 440086.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\cjdyqHVUBe\src\obj\x86\Debug\OverideEventProvider.pdb source: SOA & Invoices 440086.exe

                      Data Obfuscation:

                      barindex
                      .NET source code contains potential unpackerShow sources
                      Source: SOA & Invoices 440086.exe, Aspiring_Rookie/DebuggableAttribute.cs.Net Code: FillRecta System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 1.0.SOA & Invoices 440086.exe.670000.0.unpack, Aspiring_Rookie/DebuggableAttribute.cs.Net Code: FillRecta System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 1.2.SOA & Invoices 440086.exe.670000.0.unpack, Aspiring_Rookie/DebuggableAttribute.cs.Net Code: FillRecta System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 5.0.SOA & Invoices 440086.exe.730000.2.unpack, Aspiring_Rookie/DebuggableAttribute.cs.Net Code: FillRecta System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 5.0.SOA & Invoices 440086.exe.730000.0.unpack, Aspiring_Rookie/DebuggableAttribute.cs.Net Code: FillRecta System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00B9CE51 push es; ret
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_0780EA60 push FFFFFF8Bh; iretd
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 5_2_00DEE28A push eax; ret
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 5_2_00DED95C push eax; ret
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.86375935419
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.260304981.0000000002C51000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: SOA & Invoices 440086.exe PID: 6412, type: MEMORY
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeWMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeCode function: 1_2_011041D1 sgdt fword ptr [eax-4Ah]
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1940
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeWindow / User API: threadDelayed 4631
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeWindow / User API: threadDelayed 5177
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exe TID: 6416Thread sleep time: -103321s >= -30000s
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exe TID: 6436Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7072Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exe TID: 768Thread sleep time: -11068046444225724s >= -30000s
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exe TID: 5484Thread sleep count: 4631 > 30
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exe TID: 5484Thread sleep count: 5177 > 30
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeThread delayed: delay time: 103321
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeThread delayed: delay time: 922337203685477
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.273383217.0000000008D80000.00000004.00000001.sdmpBinary or memory string: VMware
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260304981.0000000002C51000.00000004.00000001.sdmpBinary or memory string: k%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.273383217.0000000008D80000.00000004.00000001.sdmpBinary or memory string: Win32_VideoController(Standard display types)VMwareKACN4Z6SWin32_VideoController2HBA3GRRVideoController120060621000000.000000-00091.36765display.infMSBDAKBX1H8RPPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsZ3BBKYKN]
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: VMWARE
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.273383217.0000000008D80000.00000004.00000001.sdmpBinary or memory string: Win32_VideoController(Standard display types)VMwareKACN4Z6SWin32_VideoController2HBA3GRRVideoController120060621000000.000000-00091.36765display.infMSBDAKBX1H8RPPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsZ3BBKYKN.
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.259611243.0000000000D8E000.00000004.00000020.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                      Source: SOA & Invoices 440086.exe, 00000001.00000002.260304981.0000000002C51000.00000004.00000001.sdmpBinary or memory string: k"SOFTWARE\VMware, Inc.\VMware Tools
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.511491377.00000000066D0000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeMemory allocated: page read and write | page guard

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Adds a directory exclusion to Windows DefenderShow sources
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SOA & Invoices 440086.exe'
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SOA & Invoices 440086.exe'
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeMemory written: C:\Users\user\Desktop\SOA & Invoices 440086.exe base: 400000 value starts with: 4D5A
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SOA & Invoices 440086.exe'
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeProcess created: C:\Users\user\Desktop\SOA & Invoices 440086.exe C:\Users\user\Desktop\SOA & Invoices 440086.exe
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.502692563.00000000015C0000.00000002.00000001.sdmpBinary or memory string: uProgram Manager
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.502692563.00000000015C0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.502692563.00000000015C0000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: SOA & Invoices 440086.exe, 00000005.00000002.502692563.00000000015C0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Users\user\Desktop\SOA & Invoices 440086.exe VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Users\user\Desktop\SOA & Invoices 440086.exe VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000005.00000002.496465103.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.257856351.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.262852424.0000000003C59000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 1.2.SOA & Invoices 440086.exe.3d3c548.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.SOA & Invoices 440086.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.SOA & Invoices 440086.exe.3e591c8.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.SOA & Invoices 440086.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.SOA & Invoices 440086.exe.3e591c8.1.raw.unpack, type: UNPACKEDPE
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000005.00000002.496465103.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.257856351.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.262852424.0000000003C59000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: SOA & Invoices 440086.exe PID: 6412, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: SOA & Invoices 440086.exe PID: 6668, type: MEMORY
                      Source: Yara matchFile source: 1.2.SOA & Invoices 440086.exe.3d3c548.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.SOA & Invoices 440086.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.SOA & Invoices 440086.exe.3e591c8.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.SOA & Invoices 440086.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.SOA & Invoices 440086.exe.3e591c8.1.raw.unpack, type: UNPACKEDPE
                      Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
                      Tries to harvest and steal browser information (history, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                      Tries to harvest and steal ftp login credentialsShow sources
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                      Tries to steal Mail credentials (via file access)Show sources
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                      Source: C:\Users\user\Desktop\SOA & Invoices 440086.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                      Source: Yara matchFile source: 00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: SOA & Invoices 440086.exe PID: 6668, type: MEMORY

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000005.00000002.496465103.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.257856351.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.262852424.0000000003C59000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 1.2.SOA & Invoices 440086.exe.3d3c548.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.SOA & Invoices 440086.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.SOA & Invoices 440086.exe.3e591c8.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.SOA & Invoices 440086.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.SOA & Invoices 440086.exe.3e591c8.1.raw.unpack, type: UNPACKEDPE
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000005.00000002.496465103.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.257856351.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.262852424.0000000003C59000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: SOA & Invoices 440086.exe PID: 6412, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: SOA & Invoices 440086.exe PID: 6668, type: MEMORY
                      Source: Yara matchFile source: 1.2.SOA & Invoices 440086.exe.3d3c548.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.SOA & Invoices 440086.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.SOA & Invoices 440086.exe.3e591c8.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.SOA & Invoices 440086.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.SOA & Invoices 440086.exe.3e591c8.1.raw.unpack, type: UNPACKEDPE

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation311Path InterceptionProcess Injection112Masquerading1OS Credential Dumping2Query Registry1Remote ServicesEmail Collection1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools11Input Capture1Security Software Discovery321Remote Desktop ProtocolInput Capture1Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion251Credentials in Registry1Process Discovery2SMB/Windows Admin SharesArchive Collected Data11Automated ExfiltrationNon-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection112NTDSVirtualization/Sandbox Evasion251Distributed Component Object ModelData from Local System2Scheduled TransferApplication Layer Protocol11SIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsApplication Window Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information3Cached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing13DCSyncFile and Directory Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemSystem Information Discovery114Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      SOA & Invoices 440086.exe25%VirustotalBrowse
                      SOA & Invoices 440086.exe17%ReversingLabsByteCode-MSIL.Spyware.Negasteal
                      SOA & Invoices 440086.exe100%Joe Sandbox ML

                      Dropped Files

                      No Antivirus matches

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      5.2.SOA & Invoices 440086.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File
                      5.0.SOA & Invoices 440086.exe.400000.1.unpack100%AviraTR/Spy.Gen8Download File

                      Domains

                      SourceDetectionScannerLabelLink
                      mail.framafilms.com0%VirustotalBrowse

                      URLs

                      SourceDetectionScannerLabelLink
                      http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      http://xDvmSt.com0%Avira URL Cloudsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      https://api.ipify.org%$0%Avira URL Cloudsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                      https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                      https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://mail.framafilms.com0%Avira URL Cloudsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://pU6NdWQcDtRIHGBxR.com0%Avira URL Cloudsafe

                      Domains and IPs

                      Contacted Domains

                      NameIPActiveMaliciousAntivirus DetectionReputation
                      mail.framafilms.com
                      		185.220.245.14
                      		truetrueunknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://127.0.0.1:HTTP/1.1SOA & Invoices 440086.exe, 00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		low
                      http://www.apache.org/licenses/LICENSE-2.0SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                        		high
                        http://www.fontbureau.comSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                          		high
                          http://www.fontbureau.com/designersGSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                            		high
                            http://DynDns.comDynDNSSOA & Invoices 440086.exe, 00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.com/designers/?SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                              		high
                              http://www.founder.com.cn/cn/bTheSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haSOA & Invoices 440086.exe, 00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://xDvmSt.comSOA & Invoices 440086.exe, 00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.fontbureau.com/designers?SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                		high
                                http://www.tiro.comSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designersSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                  		high
                                  http://www.goodfont.co.krSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.cssSOA & Invoices 440086.exe, 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmpfalse
                                    		high
                                    https://api.ipify.org%$SOA & Invoices 440086.exe, 00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		low
                                    http://www.carterandcone.comlSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.sajatypeworks.comSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.typography.netDSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.com/designers/cabarga.htmlNSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                      		high
                                      http://www.founder.com.cn/cn/cTheSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.galapagosdesign.com/staff/dennis.htmSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://fontfabrik.comSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.founder.com.cn/cnSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.com/designers/frere-jones.htmlSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                        		high
                                        http://www.jiyu-kobo.co.jp/SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.galapagosdesign.com/DPleaseSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.fontbureau.com/designers8SOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                          		high
                                          https://api.ipify.org%GETMozilla/5.0SOA & Invoices 440086.exe, 00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		low
                                          http://www.fonts.comSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                            		high
                                            http://www.sandoll.co.krSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.urwpp.deDPleaseSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.zhongyicts.com.cnSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            		unknown
                                            http://mail.framafilms.comSOA & Invoices 440086.exe, 00000005.00000002.508196648.0000000002DC1000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameSOA & Invoices 440086.exe, 00000001.00000002.260304981.0000000002C51000.00000004.00000001.sdmp, powershell.exe, 00000002.00000002.335650610.0000000004591000.00000004.00000001.sdmpfalse
                                              		high
                                              http://www.sakkal.comSOA & Invoices 440086.exe, 00000001.00000002.270159308.0000000005B40000.00000002.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              		unknown
                                              https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipSOA & Invoices 440086.exe, 00000001.00000002.262852424.0000000003C59000.00000004.00000001.sdmp, SOA & Invoices 440086.exe, 00000005.00000002.496465103.0000000000402000.00000040.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              		unknown
                                              https://pU6NdWQcDtRIHGBxR.comSOA & Invoices 440086.exe, 00000005.00000002.507912865.0000000002D72000.00000004.00000001.sdmp, SOA & Invoices 440086.exe, 00000005.00000003.484944761.0000000000E04000.00000004.00000001.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown

                                              Contacted IPs

                                              • No. of IPs < 25%
                                              • 25% < No. of IPs < 50%
                                              • 50% < No. of IPs < 75%
                                              • 75% < No. of IPs

                                              Public

                                              IPDomainCountryFlagASNASN NameMalicious
                                              185.220.245.14
                                              		mail.framafilms.comSwitzerland
                                              		12637SEEWEBWebhostingcolocationandcloudservicesITtrue

                                              General Information

                                              Joe Sandbox Version:32.0.0 Black Diamond
                                              Analysis ID:432713
                                              Start date:10.06.2021
                                              Start time:17:35:11
                                              Joe Sandbox Product:CloudBasic
                                              Overall analysis duration:0h 11m 17s
                                              Hypervisor based Inspection enabled:false
                                              Report type:light
                                              Sample file name:SOA & Invoices 440086.exe
                                              Cookbook file name:default.jbs
                                              Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                              Number of analysed new started processes analysed:27
                                              Number of new started drivers analysed:0
                                              Number of existing processes analysed:0
                                              Number of existing drivers analysed:0
                                              Number of injected processes analysed:0
                                              Technologies:
                                              • HCA enabled
                                              • EGA enabled
                                              • HDC enabled
                                              • AMSI enabled
                                              Analysis Mode:default
                                              Analysis stop reason:Timeout
                                              Detection:MAL
                                              Classification:mal100.troj.spyw.evad.winEXE@6/5@1/1
                                              EGA Information:Failed
                                              HDC Information:Failed
                                              HCA Information:
                                              • Successful, ratio: 100%
                                              • Number of executed functions: 0
                                              • Number of non-executed functions: 0
                                              Cookbook Comments:
                                              • Adjust boot time
                                              • Enable AMSI
                                              • Found application associated with file extension: .exe
                                              Warnings:
                                              Show All
                                              • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
                                              • Excluded IPs from analysis (whitelisted): 104.43.139.144, 13.88.21.125, 184.30.24.56, 52.255.188.83, 20.82.210.154, 2.20.142.209, 2.20.142.210, 51.103.5.186, 92.122.213.194, 92.122.213.247, 20.75.105.140, 20.72.88.19, 20.54.26.129, 20.50.102.62
                                              • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, eus2-consumerrp-displaycatalog-aks2aks-useast.md.mp.microsoft.com.akadns.net, wns.notify.trafficmanager.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, vip2-par02p.wns.notify.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                                              • Not all processes where analyzed, report is missing behavior information
                                              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                              • Report size getting too big, too many NtQueryValueKey calls found.

                                              Simulations

                                              Behavior and APIs

                                              TimeTypeDescription
                                              17:36:06API Interceptor695x Sleep call for process: SOA & Invoices 440086.exe modified

                                              Joe Sandbox View / Context

                                              IPs

                                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                              185.220.245.14BANK DETAILS.exeGet hashmaliciousBrowse
                                                SOA.rar.exeGet hashmaliciousBrowse
                                                  Invoice No. 309320.exeGet hashmaliciousBrowse
                                                    SOA.exeGet hashmaliciousBrowse
                                                      BID TENDER DOCUMENTS.exeGet hashmaliciousBrowse
                                                        PURCHASE LIST.exeGet hashmaliciousBrowse
                                                          PURCHASE LIST.exeGet hashmaliciousBrowse
                                                            SOA.rar.exeGet hashmaliciousBrowse
                                                              Bank swift.exeGet hashmaliciousBrowse
                                                                363IN050790620 BOOKING.exeGet hashmaliciousBrowse
                                                                  LIST OF PRODUCTS NEEDED.exeGet hashmaliciousBrowse
                                                                    Quote request.exeGet hashmaliciousBrowse
                                                                      REQUEST FOR QUOTAION.exeGet hashmaliciousBrowse
                                                                        REMITANCE COPY.exeGet hashmaliciousBrowse

                                                                          Domains

                                                                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                          mail.framafilms.comBANK DETAILS.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          Invoice No. 309320.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          BID TENDER DOCUMENTS.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          PURCHASE LIST.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          PURCHASE LIST.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          363IN050790620 BOOKING.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          LIST OF PRODUCTS NEEDED.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          Quote request.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          REQUEST FOR QUOTAION.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          REMITANCE COPY.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          AWD1-2001028L PI.exeGet hashmaliciousBrowse
                                                                          • 194.209.228.166
                                                                          SWIFT COPY (2).exeGet hashmaliciousBrowse
                                                                          • 194.209.228.166

                                                                          ASN

                                                                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                          SEEWEBWebhostingcolocationandcloudservicesITBANK DETAILS.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          SOA.rar.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          Invoice No. 309320.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          SOA.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          BID TENDER DOCUMENTS.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          PURCHASE LIST.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          PURCHASE LIST.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          SOA.rar.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          Bank swift.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          363IN050790620 BOOKING.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          LIST OF PRODUCTS NEEDED.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          Quote request.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          REQUEST FOR QUOTAION.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          z2xQEFs54b.exeGet hashmaliciousBrowse
                                                                          • 95.174.22.233
                                                                          INV-UR407235.xlsxGet hashmaliciousBrowse
                                                                          • 217.64.195.187
                                                                          REMITANCE COPY.exeGet hashmaliciousBrowse
                                                                          • 185.220.245.14
                                                                          Packing list #U2022 Invoice #U2022 Country of origin.exeGet hashmaliciousBrowse
                                                                          • 217.64.195.164
                                                                          990109.exeGet hashmaliciousBrowse
                                                                          • 85.94.194.169
                                                                          qkN4OZWFG6.exeGet hashmaliciousBrowse
                                                                          • 95.174.22.233
                                                                          kvdYhqN3Nh.exeGet hashmaliciousBrowse
                                                                          • 95.174.22.233

                                                                          JA3 Fingerprints

                                                                          No context

                                                                          Dropped Files

                                                                          No context

                                                                          Created / dropped Files

                                                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SOA & Invoices 440086.exe.log
                                                                          Process:C:\Users\user\Desktop\SOA & Invoices 440086.exe
                                                                          File Type:ASCII text, with CRLF line terminators
                                                                          Category:dropped
                                                                          Size (bytes):1406
                                                                          Entropy (8bit):5.341099307467139
                                                                          Encrypted:false
                                                                          SSDEEP:24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmER:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHg
                                                                          MD5:E5FA1A53BA6D70E18192AF6AF7CFDBFA
                                                                          SHA1:1C076481F11366751B8DA795C98A54DE8D1D82D5
                                                                          SHA-256:1D7BAA6D3EB5A504FD4652BC01A0864DEE898D35D9E29D03EB4A60B0D6405D83
                                                                          SHA-512:77850814E24DB48E3DDF9DF5B6A8110EE1A823BAABA800F89CD353EAC7F72E48B13F3F4A4DC8E5F0FAA707A7F14ED90577CF1CB106A0422F0BEDD1EFD2E940E4
                                                                          Malicious:true
                                                                          Reputation:moderate, very likely benign file
                                                                          Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a
                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:data
                                                                          Category:dropped
                                                                          Size (bytes):15620
                                                                          Entropy (8bit):5.538758400450401
                                                                          Encrypted:false
                                                                          SSDEEP:384:wt9Mq0NUdLHmcfIISBKnGqBSGejTrWEnEnht:eG04KGaSZDdEb
                                                                          MD5:8DC6EEB35EB08977702B894C86AA9016
                                                                          SHA1:79D899963DF69B911D24F542BF647F84FF986AFE
                                                                          SHA-256:8965D9BFA07EBE4D276FA78026994E05EDBC67D43A1CC804211BF986BD10107F
                                                                          SHA-512:82378ED08763867879FF00BCFBBE59164B1AB0F11B12D33BC695824D69FD913E3E6F7EE7099CBFDA9040BF42F247EE92BDA786E2A868247647F8D2E5E5644E2A
                                                                          Malicious:false
                                                                          Reputation:low
                                                                          Preview: @...e...........S.............q.........\.p.....................H...............<@.^.L."My...:3..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.Configuration............................................T.@..>@...@.V.@.H.@.X.@.[.@.NT@.HT@..S@..S@.hT@..S@..S@..S@.\.@..T@..T@.@X@.?X@..T@..S@..S@..T@..T@.
                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ndw2r3ux.qdp.psm1
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:very short file (no magic)
                                                                          Category:dropped
                                                                          Size (bytes):1
                                                                          Entropy (8bit):0.0
                                                                          Encrypted:false
                                                                          SSDEEP:3:U:U
                                                                          MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                          SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                          SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                          SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                          Malicious:false
                                                                          Reputation:high, very likely benign file
                                                                          Preview: 1
                                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xul1hgna.ujz.ps1
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:very short file (no magic)
                                                                          Category:dropped
                                                                          Size (bytes):1
                                                                          Entropy (8bit):0.0
                                                                          Encrypted:false
                                                                          SSDEEP:3:U:U
                                                                          MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                          SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                          SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                          SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                          Malicious:false
                                                                          Reputation:high, very likely benign file
                                                                          Preview: 1
                                                                          C:\Users\user\Documents\20210610\PowerShell_transcript.675052.2_8xSKQS.20210610173618.txt
                                                                          Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          File Type:UTF-8 Unicode (with BOM) text, with CRLF, LF line terminators
                                                                          Category:dropped
                                                                          Size (bytes):1899
                                                                          Entropy (8bit):5.103676716060941
                                                                          Encrypted:false
                                                                          SSDEEP:48:BZjv6ZoO+SRFqDYB1ZYD9cJoZjeDacJoZjPU1pA5oZZAC:BZT6ZNVqDo1ZHVJyU16uZD
                                                                          MD5:69884F699E2FBA2663FEC33116EB3EF3
                                                                          SHA1:F6F9FFA6257417743470A4556836FB7B91A9DDCB
                                                                          SHA-256:C1A5403B0B08B086F2523E58C1623BC12C7FD767E17635FF7B43E09EB61A5EC3
                                                                          SHA-512:4CCD867B807F9C591D3650EDA6EBB23A3E53201042580E7F68E45CD7E799D07CB15F2B76067344778F1381412D9E7A8296D259E7267B3580AD3BBED881A90A90
                                                                          Malicious:false
                                                                          Reputation:low
                                                                          Preview: .**********************..Windows PowerShell transcript start..Start time: 20210610173634..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 675052 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\Desktop\SOA & Invoices 440086.exe..Process ID: 6564..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20210610173634..**********************..PS>Add-MpPreference -ExclusionPath C:\Users\user\Desktop\SOA & Invoices 440086.exe..At line:1 char:64..+ ... -MpPreference -ExclusionPath C:\Users\user\Desktop\SOA & Invoice .....+

                                                                          Static File Info

                                                                          General

                                                                          File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                          Entropy (8bit):7.856941842848257
                                                                          TrID:
                                                                          • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                          • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                          • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                          • Windows Screen Saver (13104/52) 0.07%
                                                                          • Generic Win/DOS Executable (2004/3) 0.01%
                                                                          File name:SOA & Invoices 440086.exe
                                                                          File size:996864
                                                                          MD5:a5247d790d44aec18f5ec3e4ea037685
                                                                          SHA1:26633a91c4ac686a0f26a47444fa4c15798d1d2b
                                                                          SHA256:adefb18837fffc19e4477292c47b9b85d92b1fc3385b66f1a921dd84bf8a2eea
                                                                          SHA512:84f588a4cc703260519517b4aec7f8de38bf400dac0d32e696b8c6c9807e128cdeaa59c2753cac866b9a796cd2f121fdf580becd5cb657e83a84b5740a65eccc
                                                                          SSDEEP:12288:/l8VDXqxYM9iIfFKfffedzLu0HTM23UxT5eFBnFDWosrVOIYjKh+ZyKDZM4e/ZUb:tgWK0HTM23UxMFZFD9+h+ZTDNeBUdt
                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...d..`..............P..*...........I... ...`....@.. ....................................@................................

                                                                          File Icon

                                                                          Icon Hash:00828e8e8686b000

                                                                          Static PE Info

                                                                          General

                                                                          Entrypoint:0x4f4902
                                                                          Entrypoint Section:.text
                                                                          Digitally signed:false
                                                                          Imagebase:0x400000
                                                                          Subsystem:windows gui
                                                                          Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                                          DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                                          Time Stamp:0x60C1DE64 [Thu Jun 10 09:41:56 2021 UTC]
                                                                          TLS Callbacks:
                                                                          CLR (.Net) Version:v4.0.30319
                                                                          OS Version Major:4
                                                                          OS Version Minor:0
                                                                          File Version Major:4
                                                                          File Version Minor:0
                                                                          Subsystem Version Major:4
                                                                          Subsystem Version Minor:0
                                                                          Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                          Entrypoint Preview

                                                                          Instruction
                                                                          jmp dword ptr [00402000h]
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al
                                                                          add byte ptr [eax], al

                                                                          Data Directories

                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0xf48b00x4f.text
                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0xf60000x680.rsrc
                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0xf80000xc.reloc
                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0xf47780x1c.text
                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                          Sections

                                                                          NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                          .text0x20000xf29080xf2a00False0.883722147089data7.86375935419IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                          .rsrc0xf60000x6800x800False0.34423828125data3.58654294016IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                          .reloc0xf80000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                          Resources

                                                                          NameRVASizeTypeLanguageCountry
                                                                          RT_VERSION0xf60900x3f0SysEx File - OctavePlateau
                                                                          RT_MANIFEST0xf64900x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                                          Imports

                                                                          DLLImport
                                                                          mscoree.dll_CorExeMain

                                                                          Version Infos

                                                                          DescriptionData
                                                                          Translation0x0000 0x04b0
                                                                          LegalCopyrightCopyright Sutton Grammar School 2015
                                                                          Assembly Version1.0.0.0
                                                                          InternalNameOverideEventProvider.exe
                                                                          FileVersion1.0.0.0
                                                                          CompanyNameSutton Grammar School
                                                                          LegalTrademarks
                                                                          Comments
                                                                          ProductNameAspiring Rookie - Basketball
                                                                          ProductVersion1.0.0.0
                                                                          FileDescriptionAspiring Rookie - Basketball
                                                                          OriginalFilenameOverideEventProvider.exe

                                                                          Network Behavior

                                                                          Network Port Distribution

                                                                          TCP Packets

                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                          Jun 10, 2021 17:38:06.206302881 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:06.257512093 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:06.257646084 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:06.389410973 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:06.390853882 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:06.441457987 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:06.447932005 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:06.501430035 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:06.554236889 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:13.863065004 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:13.930483103 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:13.930510044 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:13.930525064 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:13.930541039 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:13.930583954 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:13.930624008 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:13.934530020 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:13.973597050 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:14.026428938 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:14.046030045 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:14.098573923 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:14.101442099 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:14.153467894 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:14.153866053 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:14.224461079 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:14.225409985 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:14.277435064 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:14.277671099 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:14.329556942 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:14.329948902 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:14.380464077 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:14.384749889 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:14.384862900 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:14.384911060 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:14.384983063 CEST49752587192.168.2.7185.220.245.14
                                                                          Jun 10, 2021 17:38:14.435452938 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:14.435484886 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:14.435504913 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:14.435523033 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:14.439363003 CEST58749752185.220.245.14192.168.2.7
                                                                          Jun 10, 2021 17:38:14.492460966 CEST49752587192.168.2.7185.220.245.14

                                                                          UDP Packets

                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                          Jun 10, 2021 17:35:55.249926090 CEST5541153192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:35:55.303771973 CEST53554118.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:35:56.264394045 CEST6366853192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:35:56.327264071 CEST53636688.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:35:57.712497950 CEST5464053192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:35:57.762967110 CEST53546408.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:35:58.698400974 CEST5873953192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:35:58.749701023 CEST53587398.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:35:59.849518061 CEST6033853192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:35:59.899764061 CEST53603388.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:00.841793060 CEST5871753192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:00.891850948 CEST53587178.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:01.947067022 CEST5976253192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:01.997571945 CEST53597628.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:03.897360086 CEST5432953192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:03.947350025 CEST53543298.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:06.269659996 CEST5805253192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:06.321196079 CEST53580528.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:09.168370008 CEST5400853192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:09.234738111 CEST53540088.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:15.042150021 CEST5945153192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:15.101860046 CEST53594518.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:16.680919886 CEST5291453192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:16.731880903 CEST53529148.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:19.652687073 CEST6456953192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:19.713246107 CEST53645698.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:20.415757895 CEST5281653192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:20.469008923 CEST53528168.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:21.331515074 CEST5078153192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:21.382210970 CEST53507818.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:22.158236980 CEST5423053192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:22.208338022 CEST53542308.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:23.228498936 CEST5491153192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:23.288362026 CEST53549118.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:24.372298956 CEST4995853192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:24.433873892 CEST53499588.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:25.250418901 CEST5086053192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:25.300316095 CEST53508608.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:26.878863096 CEST5045253192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:26.929295063 CEST53504528.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:28.116892099 CEST5973053192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:28.175400019 CEST53597308.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:32.566129923 CEST5931053192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:32.626315117 CEST53593108.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:51.055519104 CEST5191953192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:51.117263079 CEST53519198.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:36:51.996198893 CEST6429653192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:36:52.055816889 CEST53642968.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:37:08.379499912 CEST5668053192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:37:08.588253021 CEST5882053192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:37:08.648202896 CEST53588208.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:37:08.701005936 CEST53566808.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:37:09.766717911 CEST6098353192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:37:09.911125898 CEST53609838.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:37:10.971199989 CEST4924753192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:37:11.031071901 CEST53492478.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:37:11.089313984 CEST5228653192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:37:11.158989906 CEST53522868.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:37:11.842510939 CEST5606453192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:37:11.905693054 CEST53560648.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:37:12.977869034 CEST6374453192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:37:13.038765907 CEST53637448.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:37:14.469935894 CEST6145753192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:37:14.528598070 CEST53614578.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:37:15.710552931 CEST5836753192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:37:15.770044088 CEST53583678.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:37:17.624336958 CEST6059953192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:37:17.683198929 CEST53605998.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:37:19.404768944 CEST5957153192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:37:19.456583023 CEST53595718.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:37:20.234826088 CEST5268953192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:37:20.285337925 CEST53526898.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:37:33.859154940 CEST5029053192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:37:33.927903891 CEST53502908.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:37:37.427874088 CEST6042753192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:37:37.502784014 CEST53604278.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:37:55.746160984 CEST5620953192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:37:55.812762022 CEST53562098.8.8.8192.168.2.7
                                                                          Jun 10, 2021 17:38:05.974020004 CEST5958253192.168.2.78.8.8.8
                                                                          Jun 10, 2021 17:38:06.052292109 CEST53595828.8.8.8192.168.2.7

                                                                          DNS Queries

                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                          Jun 10, 2021 17:38:05.974020004 CEST192.168.2.78.8.8.80xf321Standard query (0)mail.framafilms.comA (IP address)IN (0x0001)

                                                                          DNS Answers

                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                          Jun 10, 2021 17:38:06.052292109 CEST8.8.8.8192.168.2.70xf321No error (0)mail.framafilms.com185.220.245.14A (IP address)IN (0x0001)

                                                                          SMTP Packets

                                                                          TimestampSource PortDest PortSource IPDest IPCommands
                                                                          Jun 10, 2021 17:38:06.389410973 CEST58749752185.220.245.14192.168.2.7220-chronos.hostingdomus.org ESMTP Exim 4.94.2 #2 Thu, 10 Jun 2021 17:38:06 +0200
                                                                          220-We do not authorize the use of this system to transport unsolicited,
                                                                          220 and/or bulk e-mail.
                                                                          Jun 10, 2021 17:38:06.390853882 CEST49752587192.168.2.7185.220.245.14EHLO 675052
                                                                          Jun 10, 2021 17:38:06.441457987 CEST58749752185.220.245.14192.168.2.7250-chronos.hostingdomus.org Hello 675052 [84.17.52.18]
                                                                          250-SIZE 52428800
                                                                          250-8BITMIME
                                                                          250-PIPELINING
                                                                          250-PIPE_CONNECT
                                                                          250-AUTH PLAIN LOGIN
                                                                          250-STARTTLS
                                                                          250 HELP
                                                                          Jun 10, 2021 17:38:06.447932005 CEST49752587192.168.2.7185.220.245.14STARTTLS
                                                                          Jun 10, 2021 17:38:06.501430035 CEST58749752185.220.245.14192.168.2.7220 TLS go ahead

                                                                          Code Manipulations

                                                                          Statistics

                                                                          Behavior

                                                                          Click to jump to process

                                                                          System Behavior

                                                                          Analysis Process: SOA & Invoices 440086.exe PID: 6412 Parent PID: 5756

                                                                          General

                                                                          Start time:17:36:02
                                                                          Start date:10/06/2021
                                                                          Path:C:\Users\user\Desktop\SOA & Invoices 440086.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:'C:\Users\user\Desktop\SOA & Invoices 440086.exe'
                                                                          Imagebase:0x670000
                                                                          File size:996864 bytes
                                                                          MD5 hash:A5247D790D44AEC18F5EC3E4EA037685
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:.Net C# or VB.NET
                                                                          Yara matches:
                                                                          • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.260380689.0000000002C94000.00000004.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.260304981.0000000002C51000.00000004.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.262852424.0000000003C59000.00000004.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.262852424.0000000003C59000.00000004.00000001.sdmp, Author: Joe Security
                                                                          Reputation:low

                                                                          Analysis Process: powershell.exe PID: 6564 Parent PID: 6412

                                                                          General

                                                                          Start time:17:36:13
                                                                          Start date:10/06/2021
                                                                          Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\SOA & Invoices 440086.exe'
                                                                          Imagebase:0x1110000
                                                                          File size:430592 bytes
                                                                          MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:.Net C# or VB.NET
                                                                          Reputation:high

                                                                          Analysis Process: conhost.exe PID: 6636 Parent PID: 6564

                                                                          General

                                                                          Start time:17:36:14
                                                                          Start date:10/06/2021
                                                                          Path:C:\Windows\System32\conhost.exe
                                                                          Wow64 process (32bit):false
                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          Imagebase:0x7ff774ee0000
                                                                          File size:625664 bytes
                                                                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:C, C++ or other language
                                                                          Reputation:high

                                                                          Analysis Process: SOA & Invoices 440086.exe PID: 6668 Parent PID: 6412

                                                                          General

                                                                          Start time:17:36:14
                                                                          Start date:10/06/2021
                                                                          Path:C:\Users\user\Desktop\SOA & Invoices 440086.exe
                                                                          Wow64 process (32bit):true
                                                                          Commandline:C:\Users\user\Desktop\SOA & Invoices 440086.exe
                                                                          Imagebase:0x730000
                                                                          File size:996864 bytes
                                                                          MD5 hash:A5247D790D44AEC18F5EC3E4EA037685
                                                                          Has elevated privileges:true
                                                                          Has administrator privileges:true
                                                                          Programmed in:.Net C# or VB.NET
                                                                          Yara matches:
                                                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.496465103.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000002.496465103.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.503343009.0000000002B01000.00000004.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000000.257856351.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000000.257856351.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                          Reputation:low

                                                                          Disassembly

                                                                          Code Analysis

                                                                          Reset < >