Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report Request for Price Quotation.pdf.exe

Overview

General Information

Sample Name:Request for Price Quotation.pdf.exe
Analysis ID:432812
MD5:04ff13eb3759dbe4112b49738e9f5aee
SHA1:460aa3f718ed5ce4c5d52a28fa2f275ebf076d30
SHA256:836509e2435bbae2e7d695ff94a760a0aa3e3a362edd3e2f37e907bba48f6b72
Tags:AgentTeslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension
Yara detected AgentTesla
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
.NET source code contains very large strings
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • Request for Price Quotation.pdf.exe (PID: 6496 cmdline: 'C:\Users\user\Desktop\Request for Price Quotation.pdf.exe' MD5: 04FF13EB3759DBE4112B49738E9F5AEE)
    • schtasks.exe (PID: 6672 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpD822.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 6636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • pGKuRU.exe (PID: 6744 cmdline: 'C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe' MD5: 04FF13EB3759DBE4112B49738E9F5AEE)
    • schtasks.exe (PID: 6388 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpD30D.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 6012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • pGKuRU.exe (PID: 808 cmdline: {path} MD5: 04FF13EB3759DBE4112B49738E9F5AEE)
  • pGKuRU.exe (PID: 5644 cmdline: 'C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe' MD5: 04FF13EB3759DBE4112B49738E9F5AEE)
    • schtasks.exe (PID: 6688 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpF0F5.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 6048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • pGKuRU.exe (PID: 6276 cmdline: {path} MD5: 04FF13EB3759DBE4112B49738E9F5AEE)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "mhd.nazri@vistakencana.com.mym33R3bus!mail.vistakencana.com.my"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000021.00000000.429160919.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000021.00000000.429160919.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000012.00000002.473375885.00000000032D1000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000012.00000002.473375885.00000000032D1000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          00000025.00000000.445224986.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 33 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            33.0.pGKuRU.exe.400000.1.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              33.0.pGKuRU.exe.400000.1.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                37.2.pGKuRU.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  37.2.pGKuRU.exe.400000.0.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    33.2.pGKuRU.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 19 entries

                      Sigma Overview

                      System Summary:

                      barindex
                      Sigma detected: Suspicious Double ExtensionShow sources
                      Source: Process startedAuthor: Florian Roth (rule), @blu3_team (idea): Data: Command: {path}, CommandLine: {path}, CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe, NewProcessName: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe, OriginalFileName: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe, ParentCommandLine: 'C:\Users\user\Desktop\Request for Price Quotation.pdf.exe' , ParentImage: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe, ParentProcessId: 6496, ProcessCommandLine: {path}, ProcessId: 6472

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 00000012.00000002.473375885.00000000032D1000.00000004.00000001.sdmpMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "mhd.nazri@vistakencana.com.mym33R3bus!mail.vistakencana.com.my"}
                      Multi AV Scanner detection for dropped fileShow sources
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeReversingLabs: Detection: 21%
                      Source: C:\Users\user\AppData\Roaming\vRURxcnYJm.exeReversingLabs: Detection: 21%
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: Request for Price Quotation.pdf.exeReversingLabs: Detection: 21%
                      Source: 33.0.pGKuRU.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                      Source: 37.2.pGKuRU.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 33.2.pGKuRU.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 37.0.pGKuRU.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                      Source: 18.2.Request for Price Quotation.pdf.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 18.0.Request for Price Quotation.pdf.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                      Source: Request for Price Quotation.pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll
                      Source: Request for Price Quotation.pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: mscorrc.pdb source: Request for Price Quotation.pdf.exe, 00000001.00000002.301723615.0000000006930000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.435175637.0000000006D50000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.451550450.0000000006CA0000.00000002.00000001.sdmp
                      Source: Request for Price Quotation.pdf.exe, 00000012.00000002.473375885.00000000032D1000.00000004.00000001.sdmp, pGKuRU.exe, 00000021.00000002.447853207.00000000035A1000.00000004.00000001.sdmp, pGKuRU.exe, 00000025.00000002.473835627.00000000032E1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: pGKuRU.exe, 00000025.00000002.473835627.00000000032E1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: pGKuRU.exe, 00000025.00000002.473835627.00000000032E1000.00000004.00000001.sdmpString found in binary or memory: http://lgGOBE.com
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.205550305.0000000005090000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.210317209.000000000508D000.00000004.00000001.sdmp, Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.292449495.0000000005080000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.coma
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.292449495.0000000005080000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comrsiv
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.203281814.000000000509B000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com;
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.203308968.000000000509B000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comc
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.203281814.000000000509B000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comx
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.204968127.0000000005084000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.c
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.204968127.0000000005084000.00000004.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.204952436.00000000050BD000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.204968127.0000000005084000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnS
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp///
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/3
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/E
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/NegrW
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/fet
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/uche.
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.203330941.00000000050A4000.00000004.00000001.sdmp, Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.203281814.000000000509B000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.coma-do
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.203281814.000000000509B000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comd
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.204521592.0000000005086000.00000004.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.204521592.0000000005086000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kre
                      Source: pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.203564065.000000000509B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comc
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000003.203537866.000000000509B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comtn
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.303244062.000000000BED1000.00000004.00000001.sdmp, Request for Price Quotation.pdf.exe, 00000012.00000000.291844857.0000000000402000.00000040.00000001.sdmp, pGKuRU.exe, 00000018.00000002.431644231.00000000046D1000.00000004.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.447980592.0000000004561000.00000004.00000001.sdmp, pGKuRU.exe, 00000021.00000000.429160919.0000000000402000.00000040.00000001.sdmp, pGKuRU.exe, 00000025.00000000.445224986.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: pGKuRU.exe, 00000025.00000002.473835627.00000000032E1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 18.2.Request for Price Quotation.pdf.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b5BC708AEu002dEE51u002d4E9Eu002d8C5Au002d29C17F478EFEu007d/u003446AB6DCu002dB12Au002d4788u002d854Eu002d45AA3F287DBE.csLarge array initialization: .cctor: array initializer size 11916
                      Source: 18.0.Request for Price Quotation.pdf.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007b5BC708AEu002dEE51u002d4E9Eu002d8C5Au002d29C17F478EFEu007d/u003446AB6DCu002dB12Au002d4788u002d854Eu002d45AA3F287DBE.csLarge array initialization: .cctor: array initializer size 11916
                      .NET source code contains very large stringsShow sources
                      Source: Request for Price Quotation.pdf.exe, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: vRURxcnYJm.exe.1.dr, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 1.0.Request for Price Quotation.pdf.exe.580000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 1.2.Request for Price Quotation.pdf.exe.580000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 16.0.Request for Price Quotation.pdf.exe.300000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 16.2.Request for Price Quotation.pdf.exe.300000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: pGKuRU.exe.18.dr, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 18.2.Request for Price Quotation.pdf.exe.b70000.1.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 18.0.Request for Price Quotation.pdf.exe.b70000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 18.0.Request for Price Quotation.pdf.exe.b70000.2.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 24.2.pGKuRU.exe.fd0000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 24.0.pGKuRU.exe.fd0000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 26.0.pGKuRU.exe.ee0000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: Request for Price Quotation.pdf.exe
                      Source: initial sampleStatic PE information: Filename: Request for Price Quotation.pdf.exe
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_06282A0E NtQuerySystemInformation,
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_062829D4 NtQuerySystemInformation,
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 18_2_013FB0BA NtQuerySystemInformation,
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 18_2_013FB089 NtQuerySystemInformation,
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_072527F2 NtQuerySystemInformation,
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_072527BC NtQuerySystemInformation,
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_058C26A6 NtQuerySystemInformation,
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_058C2675 NtQuerySystemInformation,
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0101F538
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01017958
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01010180
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_010141D8
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01014828
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_010120B8
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0101B0E0
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0101273C
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0101E7D8
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_010197D8
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01019BF0
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01013E78
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01013678
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0101AEA8
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_010156B0
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0101DD00
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0101DD10
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01018960
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0101F170
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01018980
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01017580
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01017590
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01016408
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_010120A9
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_010170C1
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01019F40
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01019F50
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01018F50
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01012B70
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01017788
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01017798
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0101E7C7
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_010197C8
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01019BE0
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_010163F9
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01015669
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0101AE99
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0101CEC4
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0101CEC8
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_010142F0
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0CC30070
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03322733
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_0332E758
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03323678
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03323E78
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_033256B0
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_0332AEA8
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03327958
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03320180
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_033241D3
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03324823
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03322421
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_033220B8
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_0332B0E0
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03322B70
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03329F50
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03328F50
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03329F40
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_0332E748
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03327798
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03327788
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03329BF0
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_033263F9
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03329BE0
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_033297D8
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_033283DC
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_033297C8
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03325667
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_0332AE99
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_033242F0
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_0332CEC3
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_0332CEC8
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_0332DD10
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_0332DD00
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03320170
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_0332ADBB
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03327590
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03328980
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03327580
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_033235D8
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03328426
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03326408
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_033220A9
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_0332A497
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_033270C1
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_07D519CD
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_07D50070
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_07D51ABA
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_07D50006
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05717958
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_057141D3
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05713DB8
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05710180
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05714823
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_0571B0E0
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_057120B8
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_0571E758
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05712733
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05713678
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_057156B0
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_0571AEA8
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05710170
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_0571555B
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_0571895F
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_0571894B
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_0571DD10
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05717919
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_0571DD00
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05713DF8
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05715DE0
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_057135D8
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05717590
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05718980
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05717580
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05718427
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05716408
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_057170C1
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_057120A9
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_057140A8
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05712B70
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05719F50
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05718F50
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05719BF0
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_057163F9
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05719BE0
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_057197D8
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_057183DC
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_057197C8
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05717798
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05717788
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05713E78
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05716660
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_0571363B
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_057142F0
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_0571CEC8
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_057142A0
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_0571AE9B
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_07C60070
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_07C60007
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_07C6003C
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.303591199.000000000CA70000.00000002.00000001.sdmpBinary or memory string: originalfilename vs Request for Price Quotation.pdf.exe
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.303591199.000000000CA70000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs Request for Price Quotation.pdf.exe
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.296240189.0000000002CD1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMGJMJfWcOlHYGCsdlWbhHsPUysKpteyohndxgT.exe4 vs Request for Price Quotation.pdf.exe
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.302366710.0000000006C80000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs Request for Price Quotation.pdf.exe
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.299993869.0000000006290000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameWindowsNetwork.dll> vs Request for Price Quotation.pdf.exe
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.296955820.0000000002D13000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMajorRevision.exe< vs Request for Price Quotation.pdf.exe
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.293718622.00000000005F8000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamezRdH.exeF vs Request for Price Quotation.pdf.exe
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.301723615.0000000006930000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Request for Price Quotation.pdf.exe
                      Source: Request for Price Quotation.pdf.exe, 00000010.00000000.289699259.0000000000378000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamezRdH.exeF vs Request for Price Quotation.pdf.exe
                      Source: Request for Price Quotation.pdf.exe, 00000012.00000002.476550547.0000000006300000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamezRdH.exeF vs Request for Price Quotation.pdf.exe
                      Source: Request for Price Quotation.pdf.exe, 00000012.00000002.475378599.0000000005700000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs Request for Price Quotation.pdf.exe
                      Source: Request for Price Quotation.pdf.exe, 00000012.00000002.468490022.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameMGJMJfWcOlHYGCsdlWbhHsPUysKpteyohndxgT.exe4 vs Request for Price Quotation.pdf.exe
                      Source: Request for Price Quotation.pdf.exe, 00000012.00000002.476304225.0000000005C20000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewbemdisp.tlbj% vs Request for Price Quotation.pdf.exe
                      Source: Request for Price Quotation.pdf.exeBinary or memory string: OriginalFilenamezRdH.exeF vs Request for Price Quotation.pdf.exe
                      Source: Request for Price Quotation.pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: Request for Price Quotation.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: vRURxcnYJm.exe.1.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: pGKuRU.exe.18.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: Request for Price Quotation.pdf.exe, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: vRURxcnYJm.exe.1.dr, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 1.0.Request for Price Quotation.pdf.exe.580000.0.unpack, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 1.2.Request for Price Quotation.pdf.exe.580000.0.unpack, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 16.0.Request for Price Quotation.pdf.exe.300000.0.unpack, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 16.2.Request for Price Quotation.pdf.exe.300000.0.unpack, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: classification engineClassification label: mal100.troj.evad.winEXE@20/8@0/0
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0628253E AdjustTokenPrivileges,
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_06282507 AdjustTokenPrivileges,
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 18_2_013FAF3E AdjustTokenPrivileges,
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 18_2_013FAF07 AdjustTokenPrivileges,
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_0725252A AdjustTokenPrivileges,
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_072524F3 AdjustTokenPrivileges,
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_058C252A AdjustTokenPrivileges,
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_058C24F3 AdjustTokenPrivileges,
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeFile created: C:\Users\user\AppData\Roaming\vRURxcnYJm.exeJump to behavior
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6636:120:WilError_01
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6012:120:WilError_01
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6048:120:WilError_01
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeMutant created: \Sessions\1\BaseNamedObjects\mFTSjiuFKGsZaFFdHZPfwAJpA
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeFile created: C:\Users\user\AppData\Local\Temp\tmpD822.tmpJump to behavior
                      Source: Request for Price Quotation.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: Request for Price Quotation.pdf.exeReversingLabs: Detection: 21%
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeFile read: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe 'C:\Users\user\Desktop\Request for Price Quotation.pdf.exe'
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpD822.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess created: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe {path}
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess created: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe {path}
                      Source: unknownProcess created: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe 'C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe'
                      Source: unknownProcess created: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe 'C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe'
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpD30D.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess created: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe {path}
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpF0F5.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess created: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe {path}
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpD822.tmp'
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess created: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe {path}
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess created: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe {path}
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpD30D.tmp'
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess created: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe {path}
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpF0F5.tmp'
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess created: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe {path}
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
                      Source: Request for Price Quotation.pdf.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll
                      Source: Request for Price Quotation.pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: mscorrc.pdb source: Request for Price Quotation.pdf.exe, 00000001.00000002.301723615.0000000006930000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.435175637.0000000006D50000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.451550450.0000000006CA0000.00000002.00000001.sdmp

                      Data Obfuscation:

                      barindex
                      .NET source code contains method to dynamically call methods (often used by packers)Show sources
                      Source: Request for Price Quotation.pdf.exe, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: vRURxcnYJm.exe.1.dr, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 1.0.Request for Price Quotation.pdf.exe.580000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 1.2.Request for Price Quotation.pdf.exe.580000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 16.0.Request for Price Quotation.pdf.exe.300000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 16.2.Request for Price Quotation.pdf.exe.300000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: pGKuRU.exe.18.dr, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 18.2.Request for Price Quotation.pdf.exe.b70000.1.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 18.0.Request for Price Quotation.pdf.exe.b70000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 18.0.Request for Price Quotation.pdf.exe.b70000.2.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 24.2.pGKuRU.exe.fd0000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 24.0.pGKuRU.exe.fd0000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 26.0.pGKuRU.exe.ee0000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_00EF7807 push ds; ret
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_00EF7990 push ss; ret
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_00EF790A push ss; ret
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_00EF5E34 push ds; ret
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_01012CCE push cs; ret
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0CC31383 push es; ret
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0CC31397 push cs; ret
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0CC313A3 push cs; ret
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0CC313B3 push cs; ret
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0CC31355 push cs; ret
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0CC3135B push es; ret
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0CC31463 push es; ret
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0CC3146F push es; ret
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0CC3147F push cs; ret
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0CC30007 push ds; ret
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeCode function: 1_2_0CC3142B push cs; ret
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 24_2_03322CCE push cs; ret
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeCode function: 26_2_05712CE8 push cs; ret
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.68662347155
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.68662347155
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.68662347155
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeFile created: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeJump to dropped file
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeFile created: C:\Users\user\AppData\Roaming\vRURxcnYJm.exeJump to dropped file

                      Boot Survival:

                      barindex
                      Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpD822.tmp'
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run pGKuRUJump to behavior
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run pGKuRUJump to behavior

                      Hooking and other Techniques for Hiding and Protection:

                      barindex
                      Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeFile opened: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe:Zone.Identifier read attributes | delete
                      Uses an obfuscated file name to hide its real file extension (double extension)Show sources
                      Source: Possible double extension: pdf.exeStatic PE information: Request for Price Quotation.pdf.exe
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: Process Memory Space: Request for Price Quotation.pdf.exe PID: 6496, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: pGKuRU.exe PID: 5644, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: pGKuRU.exe PID: 6744, type: MEMORY
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeWMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeWMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.296240189.0000000002CD1000.00000004.00000001.sdmp, pGKuRU.exe, 00000018.00000002.431012049.0000000003702000.00000004.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                      Source: Request for Price Quotation.pdf.exe, 00000001.00000002.296240189.0000000002CD1000.00000004.00000001.sdmp, pGKuRU.exe, 00000018.00000002.431012049.0000000003702000.00000004.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeWindow / User API: threadDelayed 428
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe TID: 6552Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe TID: 4152Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe TID: 4152Thread sleep count: 428 > 30
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe TID: 4152Thread sleep time: -12840000s >= -30000s
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe TID: 7024Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe TID: 1936Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe TID: 3980Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe TID: 6188Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe TID: 6188Thread sleep time: -90000s >= -30000s
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe TID: 6188Thread sleep time: -30000s >= -30000s
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe TID: 3636Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe TID: 3636Thread sleep time: -510000s >= -30000s
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeThread delayed: delay time: 30000
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeThread delayed: delay time: 30000
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeThread delayed: delay time: 30000
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeThread delayed: delay time: 30000
                      Source: pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: kr#"SOFTWARE\VMware, Inc.\VMware Tools
                      Source: pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
                      Source: Request for Price Quotation.pdf.exe, 00000012.00000002.475378599.0000000005700000.00000002.00000001.sdmp, pGKuRU.exe, 00000021.00000002.448452037.0000000005900000.00000002.00000001.sdmp, pGKuRU.exe, 00000025.00000002.476006527.0000000005680000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
                      Source: pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: krA"SOFTWARE\VMware, Inc.\VMware Tools
                      Source: pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                      Source: pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: kr87HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools\.
                      Source: pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: VMWARE
                      Source: pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: Request for Price Quotation.pdf.exe, 00000012.00000002.475378599.0000000005700000.00000002.00000001.sdmp, pGKuRU.exe, 00000021.00000002.448452037.0000000005900000.00000002.00000001.sdmp, pGKuRU.exe, 00000025.00000002.476006527.0000000005680000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
                      Source: Request for Price Quotation.pdf.exe, 00000012.00000002.475378599.0000000005700000.00000002.00000001.sdmp, pGKuRU.exe, 00000021.00000002.448452037.0000000005900000.00000002.00000001.sdmp, pGKuRU.exe, 00000025.00000002.476006527.0000000005680000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
                      Source: pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                      Source: pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                      Source: pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: kr&%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: kr#"SOFTWARE\VMware, Inc.\VMware ToolsH
                      Source: pGKuRU.exe, 0000001A.00000002.447069014.0000000003592000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                      Source: Request for Price Quotation.pdf.exe, 00000012.00000002.475378599.0000000005700000.00000002.00000001.sdmp, pGKuRU.exe, 00000021.00000002.448452037.0000000005900000.00000002.00000001.sdmp, pGKuRU.exe, 00000025.00000002.476006527.0000000005680000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess information queried: ProcessInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess token adjusted: Debug
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess token adjusted: Debug
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess token adjusted: Debug
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess token adjusted: Debug
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeMemory allocated: page read and write | page guard

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeMemory written: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe base: 400000 value starts with: 4D5A
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeMemory written: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe base: 400000 value starts with: 4D5A
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeMemory written: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe base: 400000 value starts with: 4D5A
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpD822.tmp'
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess created: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe {path}
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeProcess created: C:\Users\user\Desktop\Request for Price Quotation.pdf.exe {path}
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpD30D.tmp'
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess created: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe {path}
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpF0F5.tmp'
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeProcess created: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe {path}
                      Source: Request for Price Quotation.pdf.exe, 00000012.00000002.471573774.0000000001A40000.00000002.00000001.sdmp, pGKuRU.exe, 00000025.00000002.471547458.0000000001990000.00000002.00000001.sdmpBinary or memory string: Program Manager
                      Source: Request for Price Quotation.pdf.exe, 00000012.00000002.471573774.0000000001A40000.00000002.00000001.sdmp, pGKuRU.exe, 00000025.00000002.471547458.0000000001990000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: Request for Price Quotation.pdf.exe, 00000012.00000002.471573774.0000000001A40000.00000002.00000001.sdmp, pGKuRU.exe, 00000025.00000002.471547458.0000000001990000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: Request for Price Quotation.pdf.exe, 00000012.00000002.471573774.0000000001A40000.00000002.00000001.sdmp, pGKuRU.exe, 00000025.00000002.471547458.0000000001990000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeQueries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeQueries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeQueries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeQueries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exeQueries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Request for Price Quotation.pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000021.00000000.429160919.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000025.00000000.445224986.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000025.00000002.468461465.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.303244062.000000000BED1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000000.291844857.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000002.468490022.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000018.00000002.431644231.00000000046D1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.297905164.0000000003CD1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000021.00000002.446501477.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000002.447980592.0000000004561000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 33.0.pGKuRU.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 37.2.pGKuRU.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 33.2.pGKuRU.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 24.2.pGKuRU.exe.47d45f0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 26.2.pGKuRU.exe.46645f0.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 24.2.pGKuRU.exe.47d45f0.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 26.2.pGKuRU.exe.46645f0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Request for Price Quotation.pdf.exe.bf72ab8.8.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 37.0.pGKuRU.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Request for Price Quotation.pdf.exe.bf72ab8.8.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.2.Request for Price Quotation.pdf.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.0.Request for Price Quotation.pdf.exe.400000.1.unpack, type: UNPACKEDPE
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000021.00000000.429160919.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000002.473375885.00000000032D1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000025.00000000.445224986.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000025.00000002.468461465.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.303244062.000000000BED1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000000.291844857.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000002.468490022.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000018.00000002.431644231.00000000046D1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000025.00000002.473835627.00000000032E1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.297905164.0000000003CD1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000021.00000002.446501477.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000021.00000002.447853207.00000000035A1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000002.447980592.0000000004561000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Request for Price Quotation.pdf.exe PID: 6748, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Request for Price Quotation.pdf.exe PID: 6496, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: pGKuRU.exe PID: 6276, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: pGKuRU.exe PID: 5644, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: pGKuRU.exe PID: 808, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: pGKuRU.exe PID: 6744, type: MEMORY
                      Source: Yara matchFile source: 33.0.pGKuRU.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 37.2.pGKuRU.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 33.2.pGKuRU.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 24.2.pGKuRU.exe.47d45f0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 26.2.pGKuRU.exe.46645f0.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 24.2.pGKuRU.exe.47d45f0.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 26.2.pGKuRU.exe.46645f0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Request for Price Quotation.pdf.exe.bf72ab8.8.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 37.0.pGKuRU.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Request for Price Quotation.pdf.exe.bf72ab8.8.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.2.Request for Price Quotation.pdf.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.0.Request for Price Quotation.pdf.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000012.00000002.473375885.00000000032D1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000025.00000002.473835627.00000000032E1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000021.00000002.447853207.00000000035A1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Request for Price Quotation.pdf.exe PID: 6748, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: pGKuRU.exe PID: 6276, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: pGKuRU.exe PID: 808, type: MEMORY

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000021.00000000.429160919.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000025.00000000.445224986.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000025.00000002.468461465.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.303244062.000000000BED1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000000.291844857.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000002.468490022.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000018.00000002.431644231.00000000046D1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.297905164.0000000003CD1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000021.00000002.446501477.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000002.447980592.0000000004561000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 33.0.pGKuRU.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 37.2.pGKuRU.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 33.2.pGKuRU.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 24.2.pGKuRU.exe.47d45f0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 26.2.pGKuRU.exe.46645f0.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 24.2.pGKuRU.exe.47d45f0.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 26.2.pGKuRU.exe.46645f0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Request for Price Quotation.pdf.exe.bf72ab8.8.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 37.0.pGKuRU.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Request for Price Quotation.pdf.exe.bf72ab8.8.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.2.Request for Price Quotation.pdf.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.0.Request for Price Quotation.pdf.exe.400000.1.unpack, type: UNPACKEDPE
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000021.00000000.429160919.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000002.473375885.00000000032D1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000025.00000000.445224986.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000025.00000002.468461465.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.303244062.000000000BED1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000000.291844857.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000012.00000002.468490022.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000018.00000002.431644231.00000000046D1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000025.00000002.473835627.00000000032E1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.297905164.0000000003CD1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000021.00000002.446501477.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000021.00000002.447853207.00000000035A1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001A.00000002.447980592.0000000004561000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Request for Price Quotation.pdf.exe PID: 6748, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Request for Price Quotation.pdf.exe PID: 6496, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: pGKuRU.exe PID: 6276, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: pGKuRU.exe PID: 5644, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: pGKuRU.exe PID: 808, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: pGKuRU.exe PID: 6744, type: MEMORY
                      Source: Yara matchFile source: 33.0.pGKuRU.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 37.2.pGKuRU.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 33.2.pGKuRU.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 24.2.pGKuRU.exe.47d45f0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 26.2.pGKuRU.exe.46645f0.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 24.2.pGKuRU.exe.47d45f0.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 26.2.pGKuRU.exe.46645f0.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Request for Price Quotation.pdf.exe.bf72ab8.8.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 37.0.pGKuRU.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Request for Price Quotation.pdf.exe.bf72ab8.8.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.2.Request for Price Quotation.pdf.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 18.0.Request for Price Quotation.pdf.exe.400000.1.unpack, type: UNPACKEDPE

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation311Scheduled Task/Job1Access Token Manipulation1Masquerading11OS Credential DumpingSecurity Software Discovery421Remote ServicesArchive Collected Data11Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/Job1Registry Run Keys / Startup Folder1Process Injection112Disable or Modify Tools1LSASS MemoryProcess Discovery2Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Scheduled Task/Job1Virtualization/Sandbox Evasion241Security Account ManagerVirtualization/Sandbox Evasion241SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Registry Run Keys / Startup Folder1Access Token Manipulation1NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptProcess Injection112LSA SecretsFile and Directory Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonDeobfuscate/Decode Files or Information1Cached Domain CredentialsSystem Information Discovery113VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsHidden Files and Directories1DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobObfuscated Files or Information12Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Software Packing13/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 signatures2 2 Behavior Graph ID: 432812 Sample: Request for Price Quotation... Startdate: 10/06/2021 Architecture: WINDOWS Score: 100 49 Found malware configuration 2->49 51 Multi AV Scanner detection for dropped file 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 14 other signatures 2->55 7 Request for Price Quotation.pdf.exe 6 2->7         started        11 pGKuRU.exe 5 2->11         started        13 pGKuRU.exe 4 2->13         started        process3 file4 37 C:\Users\user\AppData\...\vRURxcnYJm.exe, PE32 7->37 dropped 39 C:\Users\user\AppData\Local\...\tmpD822.tmp, XML 7->39 dropped 41 Request for Price Quotation.pdf.exe.log, ASCII 7->41 dropped 57 Injects a PE file into a foreign processes 7->57 15 Request for Price Quotation.pdf.exe 2 7 7->15         started        19 schtasks.exe 1 7->19         started        21 Request for Price Quotation.pdf.exe 7->21         started        59 Multi AV Scanner detection for dropped file 11->59 61 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->61 63 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->63 65 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 11->65 23 schtasks.exe 1 11->23         started        25 pGKuRU.exe 4 11->25         started        27 schtasks.exe 13->27         started        29 pGKuRU.exe 13->29         started        signatures5 process6 file7 43 C:\Users\user\AppData\Roaming\...\pGKuRU.exe, PE32 15->43 dropped 45 C:\Users\user\...\pGKuRU.exe:Zone.Identifier, ASCII 15->45 dropped 47 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->47 31 conhost.exe 19->31         started        33 conhost.exe 23->33         started        35 conhost.exe 27->35         started        signatures8 process9

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      Request for Price Quotation.pdf.exe22%ReversingLabsByteCode-MSIL.Trojan.AgentTesla

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe22%ReversingLabsByteCode-MSIL.Trojan.AgentTesla
                      C:\Users\user\AppData\Roaming\vRURxcnYJm.exe22%ReversingLabsByteCode-MSIL.Trojan.AgentTesla

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      33.0.pGKuRU.exe.400000.1.unpack100%AviraTR/Spy.Gen8Download File
                      37.2.pGKuRU.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File
                      33.2.pGKuRU.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File
                      37.0.pGKuRU.exe.400000.1.unpack100%AviraTR/Spy.Gen8Download File
                      18.2.Request for Price Quotation.pdf.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File
                      18.0.Request for Price Quotation.pdf.exe.400000.1.unpack100%AviraTR/Spy.Gen8Download File

                      Domains

                      No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cnS0%Avira URL Cloudsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://lgGOBE.com0%Avira URL Cloudsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.carterandcone.com0%URL Reputationsafe
                      http://www.carterandcone.com0%URL Reputationsafe
                      http://www.carterandcone.com0%URL Reputationsafe
                      http://www.carterandcone.com0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/uche.0%Avira URL Cloudsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/30%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/30%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/30%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/30%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
                      http://www.fontbureau.comrsiv0%URL Reputationsafe
                      http://www.fontbureau.comrsiv0%URL Reputationsafe
                      http://www.fontbureau.comrsiv0%URL Reputationsafe
                      http://www.fontbureau.comrsiv0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sajatypeworks.comd0%Avira URL Cloudsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.fonts.comx0%URL Reputationsafe
                      http://www.fonts.comx0%URL Reputationsafe
                      http://www.fonts.comx0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://www.fonts.comc0%URL Reputationsafe
                      http://www.fonts.comc0%URL Reputationsafe
                      http://www.fonts.comc0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      http://www.founder.com.c0%URL Reputationsafe
                      http://www.founder.com.c0%URL Reputationsafe
                      http://www.founder.com.c0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/E0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/E0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/E0%URL Reputationsafe
                      http://www.sandoll.co.kre0%Avira URL Cloudsafe
                      http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                      http://www.fontbureau.coma0%URL Reputationsafe
                      http://www.fontbureau.coma0%URL Reputationsafe
                      http://www.fontbureau.coma0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp///0%Avira URL Cloudsafe
                      http://www.tiro.comtn0%Avira URL Cloudsafe

                      Domains and IPs

                      Contacted Domains

                      No contacted domains info

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://127.0.0.1:HTTP/1.1Request for Price Quotation.pdf.exe, 00000012.00000002.473375885.00000000032D1000.00000004.00000001.sdmp, pGKuRU.exe, 00000021.00000002.447853207.00000000035A1000.00000004.00000001.sdmp, pGKuRU.exe, 00000025.00000002.473835627.00000000032E1000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		low
                      http://www.fontbureau.com/designersGRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                        		high
                        http://www.fontbureau.com/designers/?Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                          		high
                          http://www.founder.com.cn/cn/bTheRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designers?Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                            		high
                            http://www.founder.com.cn/cnSRequest for Price Quotation.pdf.exe, 00000001.00000003.204968127.0000000005084000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.tiro.compGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://lgGOBE.compGKuRU.exe, 00000025.00000002.473835627.00000000032E1000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fontbureau.com/designerspGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                              		high
                              http://www.goodfont.co.krRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.carterandcone.comRequest for Price Quotation.pdf.exe, 00000001.00000003.205550305.0000000005090000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/uche.Request for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.sajatypeworks.comRequest for Price Quotation.pdf.exe, 00000001.00000003.203330941.00000000050A4000.00000004.00000001.sdmp, Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.typography.netDRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.founder.com.cn/cn/cTheRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.galapagosdesign.com/staff/dennis.htmRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://fontfabrik.comRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/3Request for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.galapagosdesign.com/DPleaseRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/Y0Request for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.comrsivRequest for Price Quotation.pdf.exe, 00000001.00000003.292449495.0000000005080000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.fonts.comRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                                		high
                                http://www.sandoll.co.krRequest for Price Quotation.pdf.exe, 00000001.00000003.204521592.0000000005086000.00000004.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.sajatypeworks.comdRequest for Price Quotation.pdf.exe, 00000001.00000003.203281814.000000000509B000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.urwpp.deDPleaseRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.zhongyicts.com.cnRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.sakkal.comRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.fonts.comxRequest for Price Quotation.pdf.exe, 00000001.00000003.203281814.000000000509B000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipRequest for Price Quotation.pdf.exe, 00000001.00000002.303244062.000000000BED1000.00000004.00000001.sdmp, Request for Price Quotation.pdf.exe, 00000012.00000000.291844857.0000000000402000.00000040.00000001.sdmp, pGKuRU.exe, 00000018.00000002.431644231.00000000046D1000.00000004.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.447980592.0000000004561000.00000004.00000001.sdmp, pGKuRU.exe, 00000021.00000000.429160919.0000000000402000.00000040.00000001.sdmp, pGKuRU.exe, 00000025.00000000.445224986.0000000000402000.00000040.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.apache.org/licenses/LICENSE-2.0Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                                  		high
                                  http://www.fontbureau.comRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                                    		high
                                    http://DynDns.comDynDNSpGKuRU.exe, 00000025.00000002.473835627.00000000032E1000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fonts.comcRequest for Price Quotation.pdf.exe, 00000001.00000003.203308968.000000000509B000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%hapGKuRU.exe, 00000025.00000002.473835627.00000000032E1000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.founder.com.cRequest for Price Quotation.pdf.exe, 00000001.00000003.204968127.0000000005084000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.jiyu-kobo.co.jp/ERequest for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.sandoll.co.kreRequest for Price Quotation.pdf.exe, 00000001.00000003.204521592.0000000005086000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.jiyu-kobo.co.jp/jp/Request for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.comaRequest for Price Quotation.pdf.exe, 00000001.00000003.292449495.0000000005080000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.jiyu-kobo.co.jp///Request for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.tiro.comtnRequest for Price Quotation.pdf.exe, 00000001.00000003.203537866.000000000509B000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.carterandcone.comlRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.founder.com.cn/cn/Request for Price Quotation.pdf.exe, 00000001.00000003.204952436.00000000050BD000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.com/designers/cabarga.htmlNRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                                      		high
                                      http://www.founder.com.cn/cnRequest for Price Quotation.pdf.exe, 00000001.00000003.204968127.0000000005084000.00000004.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.com/designers/frere-jones.htmlRequest for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                                        		high
                                        http://www.jiyu-kobo.co.jp/fetRequest for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.jiyu-kobo.co.jp/Request for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.fontbureau.com/designers8Request for Price Quotation.pdf.exe, 00000001.00000003.210317209.000000000508D000.00000004.00000001.sdmp, Request for Price Quotation.pdf.exe, 00000001.00000002.298842775.00000000051F0000.00000002.00000001.sdmp, pGKuRU.exe, 00000018.00000002.433918370.0000000005C40000.00000002.00000001.sdmp, pGKuRU.exe, 0000001A.00000002.450841292.0000000005BA0000.00000002.00000001.sdmpfalse
                                          		high
                                          http://www.jiyu-kobo.co.jp/NegrWRequest for Price Quotation.pdf.exe, 00000001.00000003.206601961.0000000005084000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.tiro.comcRequest for Price Quotation.pdf.exe, 00000001.00000003.203564065.000000000509B000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.sajatypeworks.coma-doRequest for Price Quotation.pdf.exe, 00000001.00000003.203281814.000000000509B000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.fonts.com;Request for Price Quotation.pdf.exe, 00000001.00000003.203281814.000000000509B000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		low

                                          Contacted IPs

                                          No contacted IP infos

                                          General Information

                                          Joe Sandbox Version:32.0.0 Black Diamond
                                          Analysis ID:432812
                                          Start date:10.06.2021
                                          Start time:19:15:19
                                          Joe Sandbox Product:CloudBasic
                                          Overall analysis duration:0h 12m 50s
                                          Hypervisor based Inspection enabled:false
                                          Report type:light
                                          Sample file name:Request for Price Quotation.pdf.exe
                                          Cookbook file name:default.jbs
                                          Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                          Number of analysed new started processes analysed:38
                                          Number of new started drivers analysed:0
                                          Number of existing processes analysed:0
                                          Number of existing drivers analysed:0
                                          Number of injected processes analysed:0
                                          Technologies:
                                          • HCA enabled
                                          • EGA enabled
                                          • HDC enabled
                                          • AMSI enabled
                                          Analysis Mode:default
                                          Analysis stop reason:Timeout
                                          Detection:MAL
                                          Classification:mal100.troj.evad.winEXE@20/8@0/0
                                          EGA Information:Failed
                                          HDC Information:Failed
                                          HCA Information:
                                          • Successful, ratio: 97%
                                          • Number of executed functions: 0
                                          • Number of non-executed functions: 0
                                          Cookbook Comments:
                                          • Adjust boot time
                                          • Enable AMSI
                                          • Found application associated with file extension: .exe
                                          Warnings:
                                          Show All
                                          • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe, wuapihost.exe
                                          • Not all processes where analyzed, report is missing behavior information
                                          • Report creation exceeded maximum time and may have missing disassembly code information.
                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                          • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                          • Report size getting too big, too many NtQueryValueKey calls found.

                                          Simulations

                                          Behavior and APIs

                                          TimeTypeDescription
                                          19:16:57API Interceptor647x Sleep call for process: Request for Price Quotation.pdf.exe modified
                                          19:17:07AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run pGKuRU C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe
                                          19:17:15AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run pGKuRU C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe
                                          19:17:59API Interceptor37x Sleep call for process: pGKuRU.exe modified

                                          Joe Sandbox View / Context

                                          IPs

                                          No context

                                          Domains

                                          No context

                                          ASN

                                          No context

                                          JA3 Fingerprints

                                          No context

                                          Dropped Files

                                          No context

                                          Created / dropped Files

                                          C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Request for Price Quotation.pdf.exe.log
                                          Process:C:\Users\user\Desktop\Request for Price Quotation.pdf.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):655
                                          Entropy (8bit):5.273171405160065
                                          Encrypted:false
                                          SSDEEP:12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk70Ug+9Yz9t0U2WUXBQav:MLF20NaL329hJ5g522rWz2p29XBT
                                          MD5:2703120C370FBB4A8BA08C6D1754039E
                                          SHA1:EC0DB47BF00A4A828F796147619386C0BBEA66A1
                                          SHA-256:F95566974BC44F3A757CAFB1456D185D8F333AC84775089DE18310B90C18B1BC
                                          SHA-512:BC05A2A1BE5B122FC6D3DEA66EF4258522F13351B9754378395AAD019631E312CFD3BC990F3E3D5C7BB0BDBA1EAD54A2B34A96DEE2FCCD703721E98F6192ED48
                                          Malicious:true
                                          Reputation:moderate, very likely benign file
                                          Preview: 1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\4de99804c29261edb63c93616550f034\System.Management.ni.dll",0..
                                          C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\pGKuRU.exe.log
                                          Process:C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):655
                                          Entropy (8bit):5.273171405160065
                                          Encrypted:false
                                          SSDEEP:12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk70Ug+9Yz9t0U2WUXBQav:MLF20NaL329hJ5g522rWz2p29XBT
                                          MD5:2703120C370FBB4A8BA08C6D1754039E
                                          SHA1:EC0DB47BF00A4A828F796147619386C0BBEA66A1
                                          SHA-256:F95566974BC44F3A757CAFB1456D185D8F333AC84775089DE18310B90C18B1BC
                                          SHA-512:BC05A2A1BE5B122FC6D3DEA66EF4258522F13351B9754378395AAD019631E312CFD3BC990F3E3D5C7BB0BDBA1EAD54A2B34A96DEE2FCCD703721E98F6192ED48
                                          Malicious:false
                                          Reputation:moderate, very likely benign file
                                          Preview: 1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\4de99804c29261edb63c93616550f034\System.Management.ni.dll",0..
                                          C:\Users\user\AppData\Local\Temp\tmpD30D.tmp
                                          Process:C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe
                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):1643
                                          Entropy (8bit):5.193740243738279
                                          Encrypted:false
                                          SSDEEP:24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKB3Ntn:cbh47TlNQ//rydbz9I3YODOLNdq3Zn
                                          MD5:A8C5EF69C0DCAA0802DC8DC63D9F8A16
                                          SHA1:13C7ABCB956333BFBDE72B79FB9EA7C1EFEEED7C
                                          SHA-256:9428C3990CDD00D3B6D275AAD2523BEC5D008DA747974BA46B5A2964920B6EE1
                                          SHA-512:3C38AFE9099DD037467458B07B7C262A4043AF9EAF6B6D6E0A7A86165F55C62700928F2BE780106D8234464352E73CCB34D60A03F35F3D29A9586C49DD155A15
                                          Malicious:false
                                          Reputation:low
                                          Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true
                                          C:\Users\user\AppData\Local\Temp\tmpD822.tmp
                                          Process:C:\Users\user\Desktop\Request for Price Quotation.pdf.exe
                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):1643
                                          Entropy (8bit):5.193740243738279
                                          Encrypted:false
                                          SSDEEP:24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKB3Ntn:cbh47TlNQ//rydbz9I3YODOLNdq3Zn
                                          MD5:A8C5EF69C0DCAA0802DC8DC63D9F8A16
                                          SHA1:13C7ABCB956333BFBDE72B79FB9EA7C1EFEEED7C
                                          SHA-256:9428C3990CDD00D3B6D275AAD2523BEC5D008DA747974BA46B5A2964920B6EE1
                                          SHA-512:3C38AFE9099DD037467458B07B7C262A4043AF9EAF6B6D6E0A7A86165F55C62700928F2BE780106D8234464352E73CCB34D60A03F35F3D29A9586C49DD155A15
                                          Malicious:true
                                          Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true
                                          C:\Users\user\AppData\Local\Temp\tmpF0F5.tmp
                                          Process:C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe
                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):1643
                                          Entropy (8bit):5.193740243738279
                                          Encrypted:false
                                          SSDEEP:24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKB3Ntn:cbh47TlNQ//rydbz9I3YODOLNdq3Zn
                                          MD5:A8C5EF69C0DCAA0802DC8DC63D9F8A16
                                          SHA1:13C7ABCB956333BFBDE72B79FB9EA7C1EFEEED7C
                                          SHA-256:9428C3990CDD00D3B6D275AAD2523BEC5D008DA747974BA46B5A2964920B6EE1
                                          SHA-512:3C38AFE9099DD037467458B07B7C262A4043AF9EAF6B6D6E0A7A86165F55C62700928F2BE780106D8234464352E73CCB34D60A03F35F3D29A9586C49DD155A15
                                          Malicious:false
                                          Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true
                                          C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe
                                          Process:C:\Users\user\Desktop\Request for Price Quotation.pdf.exe
                                          File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                          Category:dropped
                                          Size (bytes):483840
                                          Entropy (8bit):7.652339381133713
                                          Encrypted:false
                                          SSDEEP:6144:qw5+2TCe0Em2mReDAx49rXQTMi1+KWP2HSbs84jxIn6AJVUXND3CTM5e8nYJCa9:qwl5XmReDA+zQyPK8nv2Nzze8YJCa
                                          MD5:04FF13EB3759DBE4112B49738E9F5AEE
                                          SHA1:460AA3F718ED5CE4C5D52A28FA2F275EBF076D30
                                          SHA-256:836509E2435BBAE2E7D695FF94A760A0AA3E3A362EDD3E2F37E907BBA48F6B72
                                          SHA-512:98E9AC3BAF2ACBEB37CC4A257CC00A67568B256AB746707A123A6F1FE52D651CD432D9EE4EE7AA79EDD520C3C059419669D338634CE4AB163C48C622CCF476FB
                                          Malicious:true
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 22%
                                          Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D..`..............0..L...........k... ........@.. ....................................@..................................k..O.......\............................................................................ ............... ..H............text....K... ...L.................. ..`.rsrc...\............N..............@..@.reloc...............`..............@..B.................k......H.......@...L.......?....v..............................................^.(........}......}....*.0............t......t......o.....{....o....o......o.....{....o....o......o.....{....o....o.....o.....{....o....o.....(.......{........,....e..+......+...*..0............}.....(.......(......r...p.(....(....o......{.....(....o......{....r...po......{.....(....o......{.....(....o......{.....(....o.....*..0.._........(.........(.....o............,)....t......o....r!..p(......,..o....
                                          C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe:Zone.Identifier
                                          Process:C:\Users\user\Desktop\Request for Price Quotation.pdf.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:modified
                                          Size (bytes):26
                                          Entropy (8bit):3.95006375643621
                                          Encrypted:false
                                          SSDEEP:3:ggPYV:rPYV
                                          MD5:187F488E27DB4AF347237FE461A079AD
                                          SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                          SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                          SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                          Malicious:true
                                          Preview: [ZoneTransfer]....ZoneId=0
                                          C:\Users\user\AppData\Roaming\vRURxcnYJm.exe
                                          Process:C:\Users\user\Desktop\Request for Price Quotation.pdf.exe
                                          File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                          Category:dropped
                                          Size (bytes):483840
                                          Entropy (8bit):7.652339381133713
                                          Encrypted:false
                                          SSDEEP:6144:qw5+2TCe0Em2mReDAx49rXQTMi1+KWP2HSbs84jxIn6AJVUXND3CTM5e8nYJCa9:qwl5XmReDA+zQyPK8nv2Nzze8YJCa
                                          MD5:04FF13EB3759DBE4112B49738E9F5AEE
                                          SHA1:460AA3F718ED5CE4C5D52A28FA2F275EBF076D30
                                          SHA-256:836509E2435BBAE2E7D695FF94A760A0AA3E3A362EDD3E2F37E907BBA48F6B72
                                          SHA-512:98E9AC3BAF2ACBEB37CC4A257CC00A67568B256AB746707A123A6F1FE52D651CD432D9EE4EE7AA79EDD520C3C059419669D338634CE4AB163C48C622CCF476FB
                                          Malicious:true
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 22%
                                          Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D..`..............0..L...........k... ........@.. ....................................@..................................k..O.......\............................................................................ ............... ..H............text....K... ...L.................. ..`.rsrc...\............N..............@..@.reloc...............`..............@..B.................k......H.......@...L.......?....v..............................................^.(........}......}....*.0............t......t......o.....{....o....o......o.....{....o....o......o.....{....o....o.....o.....{....o....o.....(.......{........,....e..+......+...*..0............}.....(.......(......r...p.(....(....o......{.....(....o......{....r...po......{.....(....o......{.....(....o......{.....(....o.....*..0.._........(.........(.....o............,)....t......o....r!..p(......,..o....

                                          Static File Info

                                          General

                                          File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                          Entropy (8bit):7.652339381133713
                                          TrID:
                                          • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                          • Win32 Executable (generic) a (10002005/4) 49.75%
                                          • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                          • Windows Screen Saver (13104/52) 0.07%
                                          • Generic Win/DOS Executable (2004/3) 0.01%
                                          File name:Request for Price Quotation.pdf.exe
                                          File size:483840
                                          MD5:04ff13eb3759dbe4112b49738e9f5aee
                                          SHA1:460aa3f718ed5ce4c5d52a28fa2f275ebf076d30
                                          SHA256:836509e2435bbae2e7d695ff94a760a0aa3e3a362edd3e2f37e907bba48f6b72
                                          SHA512:98e9ac3baf2acbeb37cc4a257cc00a67568b256ab746707a123a6f1fe52d651cd432d9ee4ee7aa79edd520c3c059419669d338634ce4ab163c48c622ccf476fb
                                          SSDEEP:6144:qw5+2TCe0Em2mReDAx49rXQTMi1+KWP2HSbs84jxIn6AJVUXND3CTM5e8nYJCa9:qwl5XmReDA+zQyPK8nv2Nzze8YJCa
                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D..`..............0..L...........k... ........@.. ....................................@................................

                                          File Icon

                                          Icon Hash:18da1abcb2d2d2b0

                                          Static PE Info

                                          General

                                          Entrypoint:0x476bd6
                                          Entrypoint Section:.text
                                          Digitally signed:false
                                          Imagebase:0x400000
                                          Subsystem:windows gui
                                          Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                          DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                          Time Stamp:0x60C21444 [Thu Jun 10 13:31:48 2021 UTC]
                                          TLS Callbacks:
                                          CLR (.Net) Version:v2.0.50727
                                          OS Version Major:4
                                          OS Version Minor:0
                                          File Version Major:4
                                          File Version Minor:0
                                          Subsystem Version Major:4
                                          Subsystem Version Minor:0
                                          Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                          Entrypoint Preview

                                          Instruction
                                          jmp dword ptr [00402000h]
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al

                                          Data Directories

                                          NameVirtual AddressVirtual Size Is in Section
                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x76b840x4f.text
                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x780000x105c.rsrc
                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x7a0000xc.reloc
                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                          Sections

                                          NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                          .text0x20000x74bdc0x74c00False0.863875133833COM executable for DOS7.68662347155IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                          .rsrc0x780000x105c0x1200False0.270616319444data2.85476457294IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                          .reloc0x7a0000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                          Resources

                                          NameRVASizeTypeLanguageCountry
                                          RT_ICON0x781000x8a8dBase III DBT, version number 0, next free block index 40
                                          RT_GROUP_ICON0x789b80x14data
                                          RT_VERSION0x789dc0x480data
                                          RT_MANIFEST0x78e6c0x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                          Imports

                                          DLLImport
                                          mscoree.dll_CorExeMain

                                          Version Infos

                                          DescriptionData
                                          Translation0x0000 0x04b0
                                          LegalCopyrightDecember 19th, 2006
                                          Assembly Version1.0.7.8
                                          InternalNamezRdH.exe
                                          FileVersion1.0.7.8
                                          CompanyNameCoded by James O'Cull
                                          LegalTrademarks
                                          CommentsContact management is a solution for anyone who needs to be able to access their list of contacts from removable media without any installation.
                                          ProductNameContact Management
                                          ProductVersion1.0.7.8
                                          FileDescriptionContact Management
                                          OriginalFilenamezRdH.exe

                                          Network Behavior

                                          No network behavior found

                                          Code Manipulations

                                          Statistics

                                          Behavior

                                          Click to jump to process

                                          System Behavior

                                          Analysis Process: Request for Price Quotation.pdf.exe PID: 6496 Parent PID: 5696

                                          General

                                          Start time:19:16:06
                                          Start date:10/06/2021
                                          Path:C:\Users\user\Desktop\Request for Price Quotation.pdf.exe
                                          Wow64 process (32bit):true
                                          Commandline:'C:\Users\user\Desktop\Request for Price Quotation.pdf.exe'
                                          Imagebase:0x580000
                                          File size:483840 bytes
                                          MD5 hash:04FF13EB3759DBE4112B49738E9F5AEE
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:.Net C# or VB.NET
                                          Yara matches:
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.303244062.000000000BED1000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.303244062.000000000BED1000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.297905164.0000000003CD1000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.297905164.0000000003CD1000.00000004.00000001.sdmp, Author: Joe Security
                                          Reputation:low

                                          Analysis Process: schtasks.exe PID: 6672 Parent PID: 6496

                                          General

                                          Start time:19:16:45
                                          Start date:10/06/2021
                                          Path:C:\Windows\SysWOW64\schtasks.exe
                                          Wow64 process (32bit):true
                                          Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpD822.tmp'
                                          Imagebase:0x2f0000
                                          File size:185856 bytes
                                          MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high

                                          Analysis Process: conhost.exe PID: 6636 Parent PID: 6672

                                          General

                                          Start time:19:16:46
                                          Start date:10/06/2021
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff6b2800000
                                          File size:625664 bytes
                                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high

                                          Analysis Process: Request for Price Quotation.pdf.exe PID: 6472 Parent PID: 6496

                                          General

                                          Start time:19:16:46
                                          Start date:10/06/2021
                                          Path:C:\Users\user\Desktop\Request for Price Quotation.pdf.exe
                                          Wow64 process (32bit):false
                                          Commandline:{path}
                                          Imagebase:0x300000
                                          File size:483840 bytes
                                          MD5 hash:04FF13EB3759DBE4112B49738E9F5AEE
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low

                                          Analysis Process: Request for Price Quotation.pdf.exe PID: 6748 Parent PID: 6496

                                          General

                                          Start time:19:16:47
                                          Start date:10/06/2021
                                          Path:C:\Users\user\Desktop\Request for Price Quotation.pdf.exe
                                          Wow64 process (32bit):true
                                          Commandline:{path}
                                          Imagebase:0xb70000
                                          File size:483840 bytes
                                          MD5 hash:04FF13EB3759DBE4112B49738E9F5AEE
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:.Net C# or VB.NET
                                          Yara matches:
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000012.00000002.473375885.00000000032D1000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.473375885.00000000032D1000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000012.00000000.291844857.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000012.00000000.291844857.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000012.00000002.468490022.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000012.00000002.468490022.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                          Reputation:low

                                          Analysis Process: pGKuRU.exe PID: 6744 Parent PID: 3388

                                          General

                                          Start time:19:17:15
                                          Start date:10/06/2021
                                          Path:C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe
                                          Wow64 process (32bit):true
                                          Commandline:'C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe'
                                          Imagebase:0xfd0000
                                          File size:483840 bytes
                                          MD5 hash:04FF13EB3759DBE4112B49738E9F5AEE
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:.Net C# or VB.NET
                                          Yara matches:
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000018.00000002.431644231.00000000046D1000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000018.00000002.431644231.00000000046D1000.00000004.00000001.sdmp, Author: Joe Security
                                          Antivirus matches:
                                          • Detection: 22%, ReversingLabs
                                          Reputation:low

                                          Analysis Process: pGKuRU.exe PID: 5644 Parent PID: 3388

                                          General

                                          Start time:19:17:23
                                          Start date:10/06/2021
                                          Path:C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe
                                          Wow64 process (32bit):true
                                          Commandline:'C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe'
                                          Imagebase:0xee0000
                                          File size:483840 bytes
                                          MD5 hash:04FF13EB3759DBE4112B49738E9F5AEE
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:.Net C# or VB.NET
                                          Yara matches:
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001A.00000002.447980592.0000000004561000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000001A.00000002.447980592.0000000004561000.00000004.00000001.sdmp, Author: Joe Security
                                          Reputation:low

                                          Analysis Process: schtasks.exe PID: 6388 Parent PID: 6744

                                          General

                                          Start time:19:17:50
                                          Start date:10/06/2021
                                          Path:C:\Windows\SysWOW64\schtasks.exe
                                          Wow64 process (32bit):true
                                          Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpD30D.tmp'
                                          Imagebase:0x12d0000
                                          File size:185856 bytes
                                          MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high

                                          Analysis Process: conhost.exe PID: 6012 Parent PID: 6388

                                          General

                                          Start time:19:17:51
                                          Start date:10/06/2021
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff6b2800000
                                          File size:625664 bytes
                                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high

                                          Analysis Process: pGKuRU.exe PID: 808 Parent PID: 6744

                                          General

                                          Start time:19:17:51
                                          Start date:10/06/2021
                                          Path:C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe
                                          Wow64 process (32bit):true
                                          Commandline:{path}
                                          Imagebase:0xed0000
                                          File size:483840 bytes
                                          MD5 hash:04FF13EB3759DBE4112B49738E9F5AEE
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:.Net C# or VB.NET
                                          Yara matches:
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000021.00000000.429160919.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000021.00000000.429160919.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000021.00000002.446501477.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000021.00000002.446501477.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000021.00000002.447853207.00000000035A1000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000021.00000002.447853207.00000000035A1000.00000004.00000001.sdmp, Author: Joe Security
                                          Reputation:low

                                          Analysis Process: schtasks.exe PID: 6688 Parent PID: 5644

                                          General

                                          Start time:19:17:58
                                          Start date:10/06/2021
                                          Path:C:\Windows\SysWOW64\schtasks.exe
                                          Wow64 process (32bit):true
                                          Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\vRURxcnYJm' /XML 'C:\Users\user\AppData\Local\Temp\tmpF0F5.tmp'
                                          Imagebase:0x12d0000
                                          File size:185856 bytes
                                          MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high

                                          Analysis Process: conhost.exe PID: 6048 Parent PID: 6688

                                          General

                                          Start time:19:17:58
                                          Start date:10/06/2021
                                          Path:C:\Windows\System32\conhost.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          Imagebase:0x7ff6b2800000
                                          File size:625664 bytes
                                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high

                                          Analysis Process: pGKuRU.exe PID: 6276 Parent PID: 5644

                                          General

                                          Start time:19:17:59
                                          Start date:10/06/2021
                                          Path:C:\Users\user\AppData\Roaming\pGKuRU\pGKuRU.exe
                                          Wow64 process (32bit):true
                                          Commandline:{path}
                                          Imagebase:0xa50000
                                          File size:483840 bytes
                                          MD5 hash:04FF13EB3759DBE4112B49738E9F5AEE
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:.Net C# or VB.NET
                                          Yara matches:
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000025.00000000.445224986.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000025.00000000.445224986.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000025.00000002.468461465.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000025.00000002.468461465.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000025.00000002.473835627.00000000032E1000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000025.00000002.473835627.00000000032E1000.00000004.00000001.sdmp, Author: Joe Security
                                          Reputation:low

                                          Disassembly

                                          Code Analysis

                                          Reset < >