Loading ...

Play interactive tourEdit tour

Analysis Report Minutes of meeting June 9th.exe

Overview

General Information

Sample Name:Minutes of meeting June 9th.exe
Analysis ID:433114
MD5:ee4b5d2d220b8b925a84755e5ad9fa06
SHA1:4bfa8d3abf280cca85905ce083fe4446ac1d4862
SHA256:31e702dd0fc8ae15e8ca4991263c135709a1d64cda293a4896f89ed3b3699b77
Tags:exe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Yara detected AgentTesla
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • Minutes of meeting June 9th.exe (PID: 7048 cmdline: 'C:\Users\user\Desktop\Minutes of meeting June 9th.exe' MD5: EE4B5D2D220B8B925A84755E5AD9FA06)
    • schtasks.exe (PID: 6484 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RfuYgTevtBVukb' /XML 'C:\Users\user\AppData\Local\Temp\tmp1C49.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 5816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "jaime.navarro@crigab.cljaimecrigabmail.crigab.cl"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.909165017.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000005.00000002.909165017.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
        00000005.00000000.668170941.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000005.00000000.668170941.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
            Click to see the 8 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.Minutes of meeting June 9th.exe.3891e68.1.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              1.2.Minutes of meeting June 9th.exe.3891e68.1.raw.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                5.0.Minutes of meeting June 9th.exe.400000.1.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  5.0.Minutes of meeting June 9th.exe.400000.1.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    1.2.Minutes of meeting June 9th.exe.3891e68.1.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 3 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmpMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "jaime.navarro@crigab.cljaimecrigabmail.crigab.cl"}
                      Source: 5.0.Minutes of meeting June 9th.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                      Source: 5.2.Minutes of meeting June 9th.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: Minutes of meeting June 9th.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: Minutes of meeting June 9th.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\KcyqvrOAxz\src\obj\Debug\TopLevelAssemblyTypeResolver.pdb source: Minutes of meeting June 9th.exe
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
                      Source: global trafficTCP traffic: 192.168.2.4:49777 -> 173.249.158.24:587
                      Source: Joe Sandbox ViewASN Name: NEXCESS-NETUS NEXCESS-NETUS
                      Source: global trafficTCP traffic: 192.168.2.4:49777 -> 173.249.158.24:587
                      Source: unknownDNS traffic detected: queries for: mail.crigab.cl
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmpString found in binary or memory: http://HXowME.com
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.911271363.000000000340F000.00000004.00000001.sdmpString found in binary or memory: http://crigab.cl
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.911271363.000000000340F000.00000004.00000001.sdmpString found in binary or memory: http://mail.crigab.cl
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671470574.00000000027E1000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmp, Minutes of meeting June 9th.exe, 00000005.00000002.911253197.0000000003409000.00000004.00000001.sdmpString found in binary or memory: http://wB46twoUXvvh.net
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.653038111.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.ascendercorp.com/typedesigners.html=
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.653038111.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.ascendercorp.com/typedesigners.htmlsA
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.655341161.0000000005DFA000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.653986511.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmp, Minutes of meeting June 9th.exe, 00000001.00000003.654058805.0000000005DFB000.00000004.00000001.sdmp, Minutes of meeting June 9th.exe, 00000001.00000003.654314324.0000000005DFB000.00000004.00000001.sdmp, Minutes of meeting June 9th.exe, 00000001.00000003.654630636.0000000005DFB000.00000004.00000001.sdmp, Minutes of meeting June 9th.exe, 00000001.00000003.654283240.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.653956331.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.653986511.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersp
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.654498129.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comF
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.654630636.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comFV
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.654630636.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comT.TTF~
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.654498129.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.coma2
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.668719407.0000000005DF0000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.come.com
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.655341161.0000000005DFA000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comed
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.654058805.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comgreta2
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.654058805.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comic
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.655341161.0000000005DFA000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comico
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.654630636.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comiond
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.655341161.0000000005DFA000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comlicF
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.655341161.0000000005DFA000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.como
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.655341161.0000000005DFA000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comoitug
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.653956331.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comt$
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.655341161.0000000005DFA000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comu
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.654498129.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comuef
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.651787789.0000000005DFE000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnU
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.650864868.0000000005E03000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnesy
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: Minutes of meeting June 9th.exeString found in binary or memory: http://www.google.com
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.653261992.0000000005DFB000.00000004.00000001.sdmp, Minutes of meeting June 9th.exe, 00000001.00000003.652457687.0000000005DFC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.652883376.0000000005DFC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/-
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.652883376.0000000005DFC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/2
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.653099782.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/;
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.652457687.0000000005DFC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Hb
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.652457687.0000000005DFC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/V
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.652283694.0000000005DF4000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/W
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.653261992.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.652701098.0000000005DFC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/-
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.652701098.0000000005DFC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/V
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.653099782.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/~
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.653910343.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.de
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.653822753.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deR
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.653822753.0000000005DFB000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deos
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
                      Source: Minutes of meeting June 9th.exeString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.670227794.0000000000B2B000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 5.0.Minutes of meeting June 9th.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007b803333A8u002dEFF5u002d4E80u002d99CEu002d4C157E275DB7u007d/F3C892EFu002d20E2u002d40F9u002dA4B1u002d80E514D3763B.csLarge array initialization: .cctor: array initializer size 11932
                      Source: 5.2.Minutes of meeting June 9th.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b803333A8u002dEFF5u002d4E80u002d99CEu002d4C157E275DB7u007d/F3C892EFu002d20E2u002d40F9u002dA4B1u002d80E514D3763B.csLarge array initialization: .cctor: array initializer size 11932
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_00D9C2B0
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_00D999A0
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B93B8
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B9B40
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078BA140
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B0040
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B6F25
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B6F50
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B4D01
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078BA530
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B0BA8
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B0BA0
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B43B8
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B43B0
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B4368
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B51E1
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B6891
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B68A0
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B003F
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AFB581
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AFBF29
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AFAE08
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AF7CB0
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AFE7A0
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AF7700
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AF76F1
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AF0287
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AF0290
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AFF2F8
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AFA1D7
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AF0006
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AF0040
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AFAE03
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AFEE78
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AF7CAF
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AFDC18
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AFB9B8
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07B03290
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07B059C8
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07B060E0
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07B0B958
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07B0C8A0
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_00252050
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 5_2_00402296
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 5_2_010E3D20
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 5_2_010E9BA0
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 5_2_010EF240
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 5_2_010EAD58
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 5_2_010EACA9
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 5_2_010ED0A0
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 5_2_011B08E8
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 5_2_011B2B84
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 5_2_011B5FB0
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 5_2_011B8239
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 5_2_011B8718
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 5_2_00962050
                      Source: Minutes of meeting June 9th.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: RfuYgTevtBVukb.exe.1.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: Minutes of meeting June 9th.exe, 00000001.00000003.662013488.0000000005B55000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameTopLevelAssemblyTypeResolver.exe6 vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.681736034.000000000D8C0000.00000002.00000001.sdmpBinary or memory string: originalfilename vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.681736034.000000000D8C0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.678533661.0000000007680000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDSASignature.dll@ vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.670227794.0000000000B2B000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.681406474.0000000007C80000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameKygo.dll* vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671900306.00000000037E1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamejJgkoYsZmrwzEQxTTIcpKLqDdgl.exe4 vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.681584092.000000000D7D0000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.681334375.0000000007BF0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exeBinary or memory string: OriginalFilename vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.909165017.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamejJgkoYsZmrwzEQxTTIcpKLqDdgl.exe4 vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exe, 00000005.00000000.667890199.0000000000AB6000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameTopLevelAssemblyTypeResolver.exe6 vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.909841404.00000000010D0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx.mui vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.910078068.000000000129A000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.909466399.0000000000EF8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.909867356.00000000010F0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exeBinary or memory string: OriginalFilenameTopLevelAssemblyTypeResolver.exe6 vs Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: 5.0.Minutes of meeting June 9th.exe.400000.1.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 5.0.Minutes of meeting June 9th.exe.400000.1.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 5.2.Minutes of meeting June 9th.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 5.2.Minutes of meeting June 9th.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@6/4@2/1
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile created: C:\Users\user\AppData\Roaming\RfuYgTevtBVukb.exeJump to behavior
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5816:120:WilError_01
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeMutant created: \Sessions\1\BaseNamedObjects\qIhLjPLhpIZOsEXARyaaScPRQHt
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile created: C:\Users\user\AppData\Local\Temp\tmp1C49.tmpJump to behavior
                      Source: Minutes of meeting June 9th.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: Select * from Clientes WHERE id=@id;;
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE id=@id;
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile read: C:\Users\user\Desktop\Minutes of meeting June 9th.exe:Zone.IdentifierJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\Minutes of meeting June 9th.exe 'C:\Users\user\Desktop\Minutes of meeting June 9th.exe'
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RfuYgTevtBVukb' /XML 'C:\Users\user\AppData\Local\Temp\tmp1C49.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess created: C:\Users\user\Desktop\Minutes of meeting June 9th.exe C:\Users\user\Desktop\Minutes of meeting June 9th.exe
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RfuYgTevtBVukb' /XML 'C:\Users\user\AppData\Local\Temp\tmp1C49.tmp'
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess created: C:\Users\user\Desktop\Minutes of meeting June 9th.exe C:\Users\user\Desktop\Minutes of meeting June 9th.exe
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                      Source: Minutes of meeting June 9th.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: Minutes of meeting June 9th.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                      Source: Minutes of meeting June 9th.exeStatic file information: File size 1552896 > 1048576
                      Source: Minutes of meeting June 9th.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x152a00
                      Source: Minutes of meeting June 9th.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Minutes of meeting June 9th.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\KcyqvrOAxz\src\obj\Debug\TopLevelAssemblyTypeResolver.pdb source: Minutes of meeting June 9th.exe
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_002573C3 push 0000006Fh; ret
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B1D16 push es; retf
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_078B316D pushfd ; retf 0007h
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AF6659 push ds; retf 0007h
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AF5E01 push ss; retf 0007h
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AF5E47 push ss; retf 0007h
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07AF5DC0 push ss; retf 0007h
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 1_2_07B0AA30 push dword ptr [eax+edx-75h]; iretd
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 5_2_009673C3 push 0000006Fh; ret
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.39720072133
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.39720072133
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile created: C:\Users\user\AppData\Roaming\RfuYgTevtBVukb.exeJump to dropped file

                      Boot Survival:

                      barindex
                      Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RfuYgTevtBVukb' /XML 'C:\Users\user\AppData\Local\Temp\tmp1C49.tmp'
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Minutes of meeting June 9th.exe PID: 7048, type: MEMORY
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 240000
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239844
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239719
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239610
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239485
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239344
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239235
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239125
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239016
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 238891
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 238750
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 238641
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 238453
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 238344
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 238219
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 238110
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237953
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237828
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237719
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237610
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237453
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237344
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237235
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237094
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236985
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236860
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236735
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236594
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236469
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236360
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236203
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236078
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235969
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235860
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235735
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235610
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235453
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235344
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235235
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235094
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234985
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234875
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234766
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234594
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234485
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234344
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234235
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234094
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233953
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233844
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233719
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233610
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233500
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233391
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233282
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233157
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233047
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 232938
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeWindow / User API: threadDelayed 1001
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeWindow / User API: threadDelayed 7186
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeWindow / User API: threadDelayed 856
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeWindow / User API: threadDelayed 8958
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -5534023222112862s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -240000s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -239844s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -239719s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -239610s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -239485s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -239344s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -239235s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -239125s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -239016s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -238891s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -238750s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -238641s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -238453s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -238344s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -238219s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -238110s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -237953s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -237828s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -237719s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -237610s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -237453s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -237344s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -237235s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -237094s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -236985s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -236860s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -236735s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -236594s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -236469s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -236360s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -236203s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -236078s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -235969s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -235860s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -235735s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -235610s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -235453s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -235344s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -235235s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -235094s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -234985s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -234875s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -234766s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7052Thread sleep time: -101632s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -234594s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -234485s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -234344s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -234235s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -234094s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -233953s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -233844s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -233719s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -233610s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -233500s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -233391s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -233282s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -233157s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -233047s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 7128Thread sleep time: -232938s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 6372Thread sleep time: -13835058055282155s >= -30000s
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 6580Thread sleep count: 856 > 30
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 6580Thread sleep count: 8958 > 30
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exe TID: 6372Thread sleep count: 43 > 30
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 240000
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239844
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239719
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239610
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239485
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239344
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239235
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239125
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 239016
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 238891
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 238750
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 238641
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 238453
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 238344
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 238219
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 238110
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237953
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237828
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237719
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237610
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237453
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237344
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237235
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 237094
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236985
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236860
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236735
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236594
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236469
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236360
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236203
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 236078
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235969
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235860
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235735
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235610
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235453
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235344
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235235
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 235094
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234985
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234875
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234766
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 101632
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234594
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234485
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234344
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234235
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 234094
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233953
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233844
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233719
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233610
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233500
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233391
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233282
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233157
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 233047
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 232938
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeThread delayed: delay time: 922337203685477
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: VMWARE
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                      Source: Minutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.910178371.0000000001308000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess information queried: ProcessInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeCode function: 5_2_010ECCF0 LdrInitializeThunk,
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeMemory allocated: page read and write | page guard

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeMemory written: C:\Users\user\Desktop\Minutes of meeting June 9th.exe base: 400000 value starts with: 4D5A
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RfuYgTevtBVukb' /XML 'C:\Users\user\AppData\Local\Temp\tmp1C49.tmp'
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeProcess created: C:\Users\user\Desktop\Minutes of meeting June 9th.exe C:\Users\user\Desktop\Minutes of meeting June 9th.exe
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.910411853.00000000018F0000.00000002.00000001.sdmpBinary or memory string: Program Manager
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.910411853.00000000018F0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.910411853.00000000018F0000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: Minutes of meeting June 9th.exe, 00000005.00000002.910411853.00000000018F0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Users\user\Desktop\Minutes of meeting June 9th.exe VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Users\user\Desktop\Minutes of meeting June 9th.exe VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000005.00000002.909165017.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.668170941.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.671900306.00000000037E1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 1.2.Minutes of meeting June 9th.exe.3891e68.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.Minutes of meeting June 9th.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Minutes of meeting June 9th.exe.3891e68.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.Minutes of meeting June 9th.exe.400000.0.unpack, type: UNPACKEDPE
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000005.00000002.909165017.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.668170941.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.671900306.00000000037E1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Minutes of meeting June 9th.exe PID: 5832, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Minutes of meeting June 9th.exe PID: 7048, type: MEMORY
                      Source: Yara matchFile source: 1.2.Minutes of meeting June 9th.exe.3891e68.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.Minutes of meeting June 9th.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Minutes of meeting June 9th.exe.3891e68.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.Minutes of meeting June 9th.exe.400000.0.unpack, type: UNPACKEDPE
                      Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
                      Tries to harvest and steal browser information (history, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                      Tries to harvest and steal ftp login credentialsShow sources
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
                      Tries to steal Mail credentials (via file access)Show sources
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                      Source: C:\Users\user\Desktop\Minutes of meeting June 9th.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                      Source: Yara matchFile source: 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Minutes of meeting June 9th.exe PID: 5832, type: MEMORY

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000005.00000002.909165017.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.668170941.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.671900306.00000000037E1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 1.2.Minutes of meeting June 9th.exe.3891e68.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.Minutes of meeting June 9th.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Minutes of meeting June 9th.exe.3891e68.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.Minutes of meeting June 9th.exe.400000.0.unpack, type: UNPACKEDPE
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000005.00000002.909165017.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.668170941.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.671900306.00000000037E1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Minutes of meeting June 9th.exe PID: 5832, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Minutes of meeting June 9th.exe PID: 7048, type: MEMORY
                      Source: Yara matchFile source: 1.2.Minutes of meeting June 9th.exe.3891e68.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.Minutes of meeting June 9th.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Minutes of meeting June 9th.exe.3891e68.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.Minutes of meeting June 9th.exe.400000.0.unpack, type: UNPACKEDPE

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211Scheduled Task/Job1Process Injection112Disable or Modify Tools1OS Credential Dumping2File and Directory Discovery1Remote ServicesArchive Collected Data11Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/Job1Boot or Logon Initialization ScriptsScheduled Task/Job1Deobfuscate/Decode Files or Information1Input Capture1System Information Discovery114Remote Desktop ProtocolData from Local System2Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information3Credentials in Registry1Query Registry1SMB/Windows Admin SharesEmail Collection1Automated ExfiltrationNon-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Software Packing2NTDSSecurity Software Discovery221Distributed Component Object ModelInput Capture1Scheduled TransferApplication Layer Protocol11SIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptMasquerading1LSA SecretsProcess Discovery2SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonVirtualization/Sandbox Evasion141Cached Domain CredentialsVirtualization/Sandbox Evasion141VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsProcess Injection112DCSyncApplication Window Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemRemote System Discovery1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      No Antivirus matches

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\Users\user\AppData\Roaming\RfuYgTevtBVukb.exe9%ReversingLabsByteCode-MSIL.Trojan.Wacatac

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      5.0.Minutes of meeting June 9th.exe.400000.1.unpack100%AviraTR/Spy.Gen8Download File
                      5.2.Minutes of meeting June 9th.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File

                      Domains

                      No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                      http://www.fontbureau.comFV0%Avira URL Cloudsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://wB46twoUXvvh.net0%Avira URL Cloudsafe
                      http://www.fontbureau.comuef0%Avira URL Cloudsafe
                      http://www.fontbureau.comgreta20%Avira URL Cloudsafe
                      http://www.founder.com.cn/cnU0%Avira URL Cloudsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/Hb0%Avira URL Cloudsafe
                      http://www.ascendercorp.com/typedesigners.html=0%Avira URL Cloudsafe
                      http://www.jiyu-kobo.co.jp/~0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/~0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/~0%URL Reputationsafe
                      http://www.urwpp.deos0%Avira URL Cloudsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://www.fontbureau.comt$0%Avira URL Cloudsafe
                      http://www.jiyu-kobo.co.jp/20%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/20%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/20%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/-0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/-0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/-0%URL Reputationsafe
                      http://www.ascendercorp.com/typedesigners.htmlsA0%Avira URL Cloudsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.fontbureau.comed0%Avira URL Cloudsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.fontbureau.comoitug0%Avira URL Cloudsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.de0%URL Reputationsafe
                      http://www.urwpp.de0%URL Reputationsafe
                      http://www.urwpp.de0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/jp/V0%Avira URL Cloudsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      http://www.fontbureau.comT.TTF~0%Avira URL Cloudsafe
                      http://www.fontbureau.comlicF0%Avira URL Cloudsafe
                      http://www.jiyu-kobo.co.jp/W0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/W0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/W0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://HXowME.com0%Avira URL Cloudsafe
                      http://www.fontbureau.comF0%URL Reputationsafe
                      http://www.fontbureau.comF0%URL Reputationsafe
                      http://www.fontbureau.comF0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/V0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/V0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/V0%URL Reputationsafe
                      http://www.fontbureau.comico0%Avira URL Cloudsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      http://www.fontbureau.comic0%Avira URL Cloudsafe
                      http://www.urwpp.deR0%Avira URL Cloudsafe
                      http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                      http://mail.crigab.cl0%Avira URL Cloudsafe
                      http://www.fontbureau.come.com0%URL Reputationsafe
                      http://www.fontbureau.come.com0%URL Reputationsafe
                      http://www.fontbureau.come.com0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe

                      Domains and IPs

                      Contacted Domains

                      NameIPActiveMaliciousAntivirus DetectionReputation
                      crigab.cl
                      173.249.158.24
                      truetrue
                        unknown
                        mail.crigab.cl
                        unknown
                        unknowntrue
                          unknown

                          URLs from Memory and Binaries

                          NameSourceMaliciousAntivirus DetectionReputation
                          http://127.0.0.1:HTTP/1.1Minutes of meeting June 9th.exe, 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          low
                          http://www.fontbureau.com/designersGMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                            high
                            http://www.fontbureau.comFVMinutes of meeting June 9th.exe, 00000001.00000003.654630636.0000000005DFB000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            unknown
                            http://www.fontbureau.com/designers/?Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                              high
                              http://www.founder.com.cn/cn/bTheMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              unknown
                              http://wB46twoUXvvh.netMinutes of meeting June 9th.exe, 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmp, Minutes of meeting June 9th.exe, 00000005.00000002.911253197.0000000003409000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              unknown
                              http://www.fontbureau.comuefMinutes of meeting June 9th.exe, 00000001.00000003.654498129.0000000005DFB000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              unknown
                              http://www.fontbureau.com/designers?Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                high
                                http://www.fontbureau.comgreta2Minutes of meeting June 9th.exe, 00000001.00000003.654058805.0000000005DFB000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                unknown
                                http://www.founder.com.cn/cnUMinutes of meeting June 9th.exe, 00000001.00000003.651787789.0000000005DFE000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                unknown
                                http://www.tiro.comMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                unknown
                                http://www.fontbureau.com/designersMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmp, Minutes of meeting June 9th.exe, 00000001.00000003.654058805.0000000005DFB000.00000004.00000001.sdmp, Minutes of meeting June 9th.exe, 00000001.00000003.654314324.0000000005DFB000.00000004.00000001.sdmp, Minutes of meeting June 9th.exe, 00000001.00000003.654630636.0000000005DFB000.00000004.00000001.sdmp, Minutes of meeting June 9th.exe, 00000001.00000003.654283240.0000000005DFB000.00000004.00000001.sdmpfalse
                                  high
                                  http://www.goodfont.co.krMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  http://www.jiyu-kobo.co.jp/HbMinutes of meeting June 9th.exe, 00000001.00000003.652457687.0000000005DFC000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://www.ascendercorp.com/typedesigners.html=Minutes of meeting June 9th.exe, 00000001.00000003.653038111.0000000005DFB000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.cssMinutes of meeting June 9th.exe, 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmpfalse
                                    high
                                    http://www.jiyu-kobo.co.jp/~Minutes of meeting June 9th.exe, 00000001.00000003.653099782.0000000005DFB000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    unknown
                                    http://www.urwpp.deosMinutes of meeting June 9th.exe, 00000001.00000003.653822753.0000000005DFB000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    unknown
                                    http://www.sajatypeworks.comMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    unknown
                                    http://www.typography.netDMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    unknown
                                    http://www.founder.com.cn/cn/cTheMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    unknown
                                    http://www.galapagosdesign.com/staff/dennis.htmMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    unknown
                                    http://fontfabrik.comMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    unknown
                                    http://www.fontbureau.comt$Minutes of meeting June 9th.exe, 00000001.00000003.653956331.0000000005DFB000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    low
                                    http://www.jiyu-kobo.co.jp/2Minutes of meeting June 9th.exe, 00000001.00000003.652883376.0000000005DFC000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    unknown
                                    http://www.jiyu-kobo.co.jp/-Minutes of meeting June 9th.exe, 00000001.00000003.652883376.0000000005DFC000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    unknown
                                    http://www.ascendercorp.com/typedesigners.htmlsAMinutes of meeting June 9th.exe, 00000001.00000003.653038111.0000000005DFB000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    unknown
                                    http://www.fontbureau.com/Minutes of meeting June 9th.exe, 00000001.00000003.653986511.0000000005DFB000.00000004.00000001.sdmpfalse
                                      high
                                      http://www.galapagosdesign.com/DPleaseMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      http://www.fontbureau.comedMinutes of meeting June 9th.exe, 00000001.00000003.655341161.0000000005DFA000.00000004.00000001.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      http://www.fonts.comMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                        high
                                        http://www.sandoll.co.krMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        unknown
                                        http://www.fontbureau.comoitugMinutes of meeting June 9th.exe, 00000001.00000003.655341161.0000000005DFA000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        unknown
                                        http://www.urwpp.deDPleaseMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        unknown
                                        http://www.urwpp.deMinutes of meeting June 9th.exe, 00000001.00000003.653910343.0000000005DFB000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        unknown
                                        http://www.zhongyicts.com.cnMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        unknown
                                        http://www.jiyu-kobo.co.jp/jp/VMinutes of meeting June 9th.exe, 00000001.00000003.652701098.0000000005DFC000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        unknown
                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameMinutes of meeting June 9th.exe, 00000001.00000002.671470574.00000000027E1000.00000004.00000001.sdmpfalse
                                          high
                                          http://www.fontbureau.com/designerspMinutes of meeting June 9th.exe, 00000001.00000003.653986511.0000000005DFB000.00000004.00000001.sdmpfalse
                                            high
                                            http://www.sakkal.comMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            unknown
                                            https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipMinutes of meeting June 9th.exefalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            unknown
                                            http://www.fontbureau.comT.TTF~Minutes of meeting June 9th.exe, 00000001.00000003.654630636.0000000005DFB000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            low
                                            http://www.fontbureau.comlicFMinutes of meeting June 9th.exe, 00000001.00000003.655341161.0000000005DFA000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            unknown
                                            http://www.apache.org/licenses/LICENSE-2.0Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                              high
                                              http://www.fontbureau.comMinutes of meeting June 9th.exe, 00000001.00000003.655341161.0000000005DFA000.00000004.00000001.sdmpfalse
                                                high
                                                http://www.jiyu-kobo.co.jp/WMinutes of meeting June 9th.exe, 00000001.00000003.652283694.0000000005DF4000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                http://DynDns.comDynDNSMinutes of meeting June 9th.exe, 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                http://HXowME.comMinutes of meeting June 9th.exe, 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                unknown
                                                http://www.fontbureau.comFMinutes of meeting June 9th.exe, 00000001.00000003.654498129.0000000005DFB000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                http://www.jiyu-kobo.co.jp/VMinutes of meeting June 9th.exe, 00000001.00000003.652457687.0000000005DFC000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                http://www.fontbureau.comicoMinutes of meeting June 9th.exe, 00000001.00000003.655341161.0000000005DFA000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                unknown
                                                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haMinutes of meeting June 9th.exe, 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                http://www.fontbureau.comicMinutes of meeting June 9th.exe, 00000001.00000003.654058805.0000000005DFB000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                unknown
                                                http://www.urwpp.deRMinutes of meeting June 9th.exe, 00000001.00000003.653822753.0000000005DFB000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                unknown
                                                http://www.jiyu-kobo.co.jp/jp/Minutes of meeting June 9th.exe, 00000001.00000003.653261992.0000000005DFB000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                http://mail.crigab.clMinutes of meeting June 9th.exe, 00000005.00000002.911271363.000000000340F000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                unknown
                                                http://www.fontbureau.come.comMinutes of meeting June 9th.exe, 00000001.00000003.668719407.0000000005DF0000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                http://www.carterandcone.comlMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                http://www.jiyu-kobo.co.jp/;Minutes of meeting June 9th.exe, 00000001.00000003.653099782.0000000005DFB000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                http://www.fontbureau.coma2Minutes of meeting June 9th.exe, 00000001.00000003.654498129.0000000005DFB000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                unknown
                                                http://www.fontbureau.com/designers/cabarga.htmlNMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                                  high
                                                  http://www.fontbureau.comiondMinutes of meeting June 9th.exe, 00000001.00000003.654630636.0000000005DFB000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://www.founder.com.cn/cnMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  unknown
                                                  http://www.fontbureau.com/designers/frere-user.htmlMinutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                                    high
                                                    http://www.jiyu-kobo.co.jp/Minutes of meeting June 9th.exe, 00000001.00000003.653261992.0000000005DFB000.00000004.00000001.sdmp, Minutes of meeting June 9th.exe, 00000001.00000003.652457687.0000000005DFC000.00000004.00000001.sdmpfalse
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    unknown
                                                    http://www.fontbureau.comoMinutes of meeting June 9th.exe, 00000001.00000003.655341161.0000000005DFA000.00000004.00000001.sdmpfalse
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    unknown
                                                    http://www.jiyu-kobo.co.jp/jp/-Minutes of meeting June 9th.exe, 00000001.00000003.652701098.0000000005DFC000.00000004.00000001.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    unknown
                                                    http://www.fontbureau.com/designers8Minutes of meeting June 9th.exe, 00000001.00000002.675580325.0000000005EE0000.00000002.00000001.sdmpfalse
                                                      high
                                                      http://www.fontbureau.comuMinutes of meeting June 9th.exe, 00000001.00000003.655341161.0000000005DFA000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      http://www.fontbureau.com/designers/Minutes of meeting June 9th.exe, 00000001.00000003.653956331.0000000005DFB000.00000004.00000001.sdmpfalse
                                                        high
                                                        http://crigab.clMinutes of meeting June 9th.exe, 00000005.00000002.911271363.000000000340F000.00000004.00000001.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        unknown
                                                        http://www.founder.com.cn/cnesyMinutes of meeting June 9th.exe, 00000001.00000003.650864868.0000000005E03000.00000004.00000001.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        unknown

                                                        Contacted IPs

                                                        • No. of IPs < 25%
                                                        • 25% < No. of IPs < 50%
                                                        • 50% < No. of IPs < 75%
                                                        • 75% < No. of IPs

                                                        Public

                                                        IPDomainCountryFlagASNASN NameMalicious
                                                        173.249.158.24
                                                        crigab.clUnited States
                                                        36444NEXCESS-NETUStrue

                                                        General Information

                                                        Joe Sandbox Version:32.0.0 Black Diamond
                                                        Analysis ID:433114
                                                        Start date:11.06.2021
                                                        Start time:10:33:15
                                                        Joe Sandbox Product:CloudBasic
                                                        Overall analysis duration:0h 8m 47s
                                                        Hypervisor based Inspection enabled:false
                                                        Report type:light
                                                        Sample file name:Minutes of meeting June 9th.exe
                                                        Cookbook file name:default.jbs
                                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                        Number of analysed new started processes analysed:17
                                                        Number of new started drivers analysed:0
                                                        Number of existing processes analysed:0
                                                        Number of existing drivers analysed:0
                                                        Number of injected processes analysed:0
                                                        Technologies:
                                                        • HCA enabled
                                                        • EGA enabled
                                                        • HDC enabled
                                                        • AMSI enabled
                                                        Analysis Mode:default
                                                        Analysis stop reason:Timeout
                                                        Detection:MAL
                                                        Classification:mal100.troj.spyw.evad.winEXE@6/4@2/1
                                                        EGA Information:Failed
                                                        HDC Information:
                                                        • Successful, ratio: 0.3% (good quality ratio 0.2%)
                                                        • Quality average: 44.3%
                                                        • Quality standard deviation: 30.1%
                                                        HCA Information:
                                                        • Successful, ratio: 91%
                                                        • Number of executed functions: 0
                                                        • Number of non-executed functions: 0
                                                        Cookbook Comments:
                                                        • Adjust boot time
                                                        • Enable AMSI
                                                        • Found application associated with file extension: .exe
                                                        Warnings:
                                                        Show All
                                                        • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
                                                        • Excluded IPs from analysis (whitelisted): 52.147.198.201, 52.113.196.254, 13.107.3.254, 13.107.246.254, 104.43.139.144, 104.43.193.48, 168.61.161.212, 20.82.210.154, 20.54.104.15, 20.54.26.129, 2.20.142.209, 2.20.142.210, 20.82.209.183, 92.122.213.194, 92.122.213.247
                                                        • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, s-ring.msedge.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, teams-9999.teams-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, s-ring.s-9999.s-msedge.net, t-ring.msedge.net, skypedataprdcolcus15.cloudapp.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, t-9999.t-msedge.net, s-9999.s-msedge.net, blobcollector.events.data.trafficmanager.net, teams-ring.teams-9999.teams-msedge.net, teams-ring.msedge.net, t-ring.t-9999.t-msedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net
                                                        • Not all processes where analyzed, report is missing behavior information
                                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                        • Report size getting too big, too many NtQueryValueKey calls found.

                                                        Simulations

                                                        Behavior and APIs

                                                        TimeTypeDescription
                                                        10:34:02API Interceptor759x Sleep call for process: Minutes of meeting June 9th.exe modified

                                                        Joe Sandbox View / Context

                                                        IPs

                                                        No context

                                                        Domains

                                                        No context

                                                        ASN

                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                        NEXCESS-NETUSMiral-Purushotham.verra.htmGet hashmaliciousBrowse
                                                        • 173.249.159.98
                                                        BL Draft copy.exeGet hashmaliciousBrowse
                                                        • 67.20.61.90
                                                        RFQ Order - Mediform S.A-pdf.exeGet hashmaliciousBrowse
                                                        • 209.126.18.3
                                                        https://joom.ag/yGUCGet hashmaliciousBrowse
                                                        • 67.20.61.14
                                                        https://saveunbornlife.org/wp-includes/random_compat/fireweb/login.html#info@americasleading.comGet hashmaliciousBrowse
                                                        • 209.87.159.167
                                                        Claim-2020190722-10092020.xlsGet hashmaliciousBrowse
                                                        • 8.29.130.206
                                                        Claim-2020190722-10092020.xlsGet hashmaliciousBrowse
                                                        • 8.29.130.206
                                                        https://4ac1b1774f.nxcli.net/content/adobe-RD28/index.htmlGet hashmaliciousBrowse
                                                        • 8.29.157.202
                                                        https://4ac1b1774f.nxcli.net/content/adobe-RD28/index.htmlGet hashmaliciousBrowse
                                                        • 8.29.157.202
                                                        https://u13866594.ct.sendgrid.net/ls/click?upn=zXrfjgsxrhwKJV2JEsds02DTKlA-2FKjP3ouTKap6tb-2BaHzPZGmjljWdY-2B8eIVgUp6FZt5WEBkptcUgYHGhLdiXIOOcI4quBIBQq-2FI5KivR9ZJcyXiEilPAbFSOTDEzsr8Wg7E9oxBKcFAygB5REMrDA-3D-3DfSmP_JrfdLO9c93xZuhsRHgFhRVDV8bLIln4lYk4aksXNrQT2hmY9LW1-2BwLQhc6eTeTp4EE5NUs8Klx5-2Fha7j5IkjVAbFl1T37-2BhQ2JWSaf7-2FBSF9alW21qJuxs-2B5W9BOyD1t4-2BxoIqaCGgqkyhimaS73eUj7LLB8nO3AAnBWZFTFKyd1HKj5Vs7AyIQ6lif5qThylDp9fqArjJYdvxUltYS65reC4G6lXlAEY85yMHqyEg8-3DGet hashmaliciousBrowse
                                                        • 173.249.151.38
                                                        http://u8824451.ct.sendgrid.net/ls/click?upn=5fYtplO-2FP4S37YYMUNVFFIYhCASYIhBbksOQ-2FihRkfMagXRLczMdDWyGKLdaZ2fGhDy-2F2d9wvh3PmFD5Sd8YlrIZf9YbBnjsARk2gQWkDh7EtRQeoc6vexcl-2F5xnJda6NJSpa6VgcIL99Z9lzFDK2g-3D-3DJZGb_Zf9noBSXp6zmd8gcAmse0KbOcMdKjdFVksgJt8-2FyUPRtkP4eQAkARHJz9LCsuAXZYmX90WUOo27t0l8tRPd-2BGboZnCD837dyUOzvwZQdq8YyTSBwQz1tmOMo8vOOGjUDn7S-2B-2BvWNHLAYT3doPJ5P9O4MJLNaRyHO39WJVaD-2FaysKv78DQH3AuD-2Br9cP-2Fkv2RSdS4tsTx8jv2duyxUVT2HF-2FSG9MUjWRrKmvZe0PvAPM-3DGet hashmaliciousBrowse
                                                        • 209.126.25.245
                                                        Electronic form.docGet hashmaliciousBrowse
                                                        • 173.249.157.230
                                                        Electronic form.docGet hashmaliciousBrowse
                                                        • 173.249.157.230
                                                        Electronic form.docGet hashmaliciousBrowse
                                                        • 173.249.157.230
                                                        https://u14688309.ct.sendgrid.net/ls/click?upn=cYiEKVN9lp-2Fx5BNj7S4OzK5I0wmQnNsEyIXHxuR49Y0mFRm5J-2FOvpTZPGVL-2FGaaV1CNEoN1qO2tnUYAsgY7JeZw8g-2FkrIoH7rbEUkNbx58SdDpO0thwug5jJN-2Frup8vaurnMgjuwNweyZIS2CZ3jkA-3D-3DT50W_5fL-2BdZKd8ocMNHc9SFg5eh8Z492W4iYSRnF7u-2BCYs3ycMEdZGjLCvGu2ugUBziXSXaqkh1V-2Fsa99ub68wrh5OdrzEnVOu7TsGbzWwItjPTAUliDykKj-2BrGf-2FnoWP8k64P1CqxPB7O6uti-2BRXKqKaFo62vIKvcgA6010v7qKaYTDacfsNG-2FrdMkVVmeY92oyIYHVAFv40AyUGcaYUyimPMp-2BUSUwNLaX-2B-2FFzXvJQNPfi1wlnZNSvwMO-2FCM-2F5SSLgeGet hashmaliciousBrowse
                                                        • 209.126.25.245
                                                        https://u14688309.ct.sendgrid.net/ls/click?upn=cYiEKVN9lp-2Fx5BNj7S4OzK5I0wmQnNsEyIXHxuR49Y0mFRm5J-2FOvpTZPGVL-2FGaaV1CNEoN1qO2tnUYAsgY7JeZw8g-2FkrIoH7rbEUkNbx58SdDpO0thwug5jJN-2Frup8vaurnMgjuwNweyZIS2CZ3jkA-3D-3DtIcy_5fL-2BdZKd8ocMNHc9SFg5eh8Z492W4iYSRnF7u-2BCYs3ycMEdZGjLCvGu2ugUBziXSXaqkh1V-2Fsa99ub68wrh5OYz6cwOQ7Ot7CgyHJLSBUMG4eMwFRNpKSXwViJxXZcm-2Fun8LUg4JO6z5VtX1zs4YB-2Fft6HB6af-2B0DDiujru0fMifBRcnU9Fi-2FbYW8hlsgmAQC6pODhn8vANdinP-2FA-2FtozTt92M3JpYIKg6Jj-2BLa7t1zJrg6EOnVP-2FGO59JpMZSlpGet hashmaliciousBrowse
                                                        • 209.126.25.245
                                                        QW8524983075IS.docGet hashmaliciousBrowse
                                                        • 173.249.157.230
                                                        QW8524983075IS.docGet hashmaliciousBrowse
                                                        • 173.249.157.230
                                                        QW8524983075IS.docGet hashmaliciousBrowse
                                                        • 173.249.157.230
                                                        mZebTSV5Pp.docGet hashmaliciousBrowse
                                                        • 173.249.157.230

                                                        JA3 Fingerprints

                                                        No context

                                                        Dropped Files

                                                        No context

                                                        Created / dropped Files

                                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Minutes of meeting June 9th.exe.log
                                                        Process:C:\Users\user\Desktop\Minutes of meeting June 9th.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:modified
                                                        Size (bytes):1400
                                                        Entropy (8bit):5.344635889251176
                                                        Encrypted:false
                                                        SSDEEP:24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEg:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHV
                                                        MD5:394E646B019FF472CE37EE76A647A27F
                                                        SHA1:BD5872D88EE9CD2299B5F0E462C53D9E7040D6DA
                                                        SHA-256:2295A0B1F6ACD75FB5D038ADE65725EDF3DDF076107AEA93E4A864E35974AE2A
                                                        SHA-512:7E95510C85262998AECC9A06A73A5BF6352304AF6EE143EC7E48A17473773F33A96A2F4146446444789B8BCC9B83372A227DC89C3D326A2E142BCA1E1A9B4809
                                                        Malicious:false
                                                        Reputation:moderate, very likely benign file
                                                        Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a
                                                        C:\Users\user\AppData\Local\Temp\tmp1C49.tmp
                                                        Process:C:\Users\user\Desktop\Minutes of meeting June 9th.exe
                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):1647
                                                        Entropy (8bit):5.184913133325714
                                                        Encrypted:false
                                                        SSDEEP:24:2dH4+SEqC/S7hblNMFp//rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBGQ9tn:cbhK79lNQR/rydbz9I3YODOLNdq31
                                                        MD5:51A0296D50D19C44A767FB7256285438
                                                        SHA1:F5D712FADFAF2975F12F55E357FDBF9DB6CC3772
                                                        SHA-256:1E8EED0B81F03036E346C7C79FCBE10E68D152162903F4282BB12841F64399AA
                                                        SHA-512:E1AFA3981131BB90DD0CC03808DBD1FC7E891D99DAA8EC8719669599A0B84B95F0B2F4C1AEE733F759A9616D2894579543DD40939D446C0F765D65475E6CBC7C
                                                        Malicious:true
                                                        Reputation:low
                                                        Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true
                                                        C:\Users\user\AppData\Roaming\RfuYgTevtBVukb.exe
                                                        Process:C:\Users\user\Desktop\Minutes of meeting June 9th.exe
                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                        Category:dropped
                                                        Size (bytes):1552896
                                                        Entropy (8bit):7.307230517877139
                                                        Encrypted:false
                                                        SSDEEP:24576:5ONeBUdtwsEgwsoe/z8YEoqSg5LlJfH6zMIDsxTt8nUhqF+39k6aq0+imRIyY/r:EwBUwsEgwsoe5U/BldO/jFyHaq0lyIye
                                                        MD5:EE4B5D2D220B8B925A84755E5AD9FA06
                                                        SHA1:4BFA8D3ABF280CCA85905CE083FE4446AC1D4862
                                                        SHA-256:31E702DD0FC8AE15E8CA4991263C135709A1D64CDA293A4896F89ED3B3699B77
                                                        SHA-512:101B8FEC687AAA86F558188832C3A0C77264EDE18A962772E68C678C24D6FFBEA135188B53D291641A472A27E4241A152180960B45428435CA359E20AD214F2A
                                                        Malicious:false
                                                        Antivirus:
                                                        • Antivirus: ReversingLabs, Detection: 9%
                                                        Reputation:low
                                                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............P..*...........I... ...`....@.. ....................... ............@..................................H..O....`...............................G............................................... ............... ..H............text...4)... ...*.................. ..`.rsrc........`.......,..............@..@.reloc..............................@..B.................I......H............D...........................................................0............(....(..........(.....o.....*.....................( ......(!......("......(#......($....*N..(....o....(%....*&..(&....*.s'........s(........s)........s*........s+........*....0...........~....o,....+..*.0...........~....o-....+..*.0...........~....o.....+..*.0...........~....o/....+..*.0...........~....o0....+..*&..(1....*...0..<........~.....(2.....,!r...p.....(3...o4...s5............~.....
                                                        C:\Users\user\AppData\Roaming\RfuYgTevtBVukb.exe:Zone.Identifier
                                                        Process:C:\Users\user\Desktop\Minutes of meeting June 9th.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):26
                                                        Entropy (8bit):3.95006375643621
                                                        Encrypted:false
                                                        SSDEEP:3:ggPYV:rPYV
                                                        MD5:187F488E27DB4AF347237FE461A079AD
                                                        SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                        SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                        SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                        Malicious:false
                                                        Reputation:high, very likely benign file
                                                        Preview: [ZoneTransfer]....ZoneId=0

                                                        Static File Info

                                                        General

                                                        File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                        Entropy (8bit):7.307230517877139
                                                        TrID:
                                                        • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                        • Win32 Executable (generic) a (10002005/4) 49.78%
                                                        • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                        • Generic Win/DOS Executable (2004/3) 0.01%
                                                        • DOS Executable Generic (2002/1) 0.01%
                                                        File name:Minutes of meeting June 9th.exe
                                                        File size:1552896
                                                        MD5:ee4b5d2d220b8b925a84755e5ad9fa06
                                                        SHA1:4bfa8d3abf280cca85905ce083fe4446ac1d4862
                                                        SHA256:31e702dd0fc8ae15e8ca4991263c135709a1d64cda293a4896f89ed3b3699b77
                                                        SHA512:101b8fec687aaa86f558188832c3a0c77264ede18a962772e68c678c24d6ffbea135188b53d291641a472a27e4241a152180960b45428435ca359e20ad214f2a
                                                        SSDEEP:24576:5ONeBUdtwsEgwsoe/z8YEoqSg5LlJfH6zMIDsxTt8nUhqF+39k6aq0+imRIyY/r:EwBUwsEgwsoe5U/BldO/jFyHaq0lyIye
                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............P..*...........I... ...`....@.. ....................... ............@................................

                                                        File Icon

                                                        Icon Hash:e0c6a169f4bed870

                                                        Static PE Info

                                                        General

                                                        Entrypoint:0x55492e
                                                        Entrypoint Section:.text
                                                        Digitally signed:false
                                                        Imagebase:0x400000
                                                        Subsystem:windows gui
                                                        Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                        DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                        Time Stamp:0x60C3140B [Fri Jun 11 07:43:07 2021 UTC]
                                                        TLS Callbacks:
                                                        CLR (.Net) Version:v4.0.30319
                                                        OS Version Major:4
                                                        OS Version Minor:0
                                                        File Version Major:4
                                                        File Version Minor:0
                                                        Subsystem Version Major:4
                                                        Subsystem Version Minor:0
                                                        Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                        Entrypoint Preview

                                                        Instruction
                                                        jmp dword ptr [00402000h]
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al

                                                        Data Directories

                                                        NameVirtual AddressVirtual Size Is in Section
                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x1548dc0x4f.text
                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x1560000x2838c.rsrc
                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x1800000xc.reloc
                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x1547a40x1c.text
                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                        Sections

                                                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                        .text0x20000x1529340x152a00False0.699034901024data7.39720072133IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                        .rsrc0x1560000x2838c0x28400False0.599845933618data6.35335609293IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .reloc0x1800000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                        Resources

                                                        NameRVASizeTypeLanguageCountry
                                                        RT_ICON0x1561a00x468GLS_BINARY_LSB_FIRST
                                                        RT_ICON0x1566180x10a8dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
                                                        RT_ICON0x1576d00x25a8dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
                                                        RT_ICON0x159c880x4228dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
                                                        RT_ICON0x15dec00x10828dBase III DBT, version number 0, next free block index 40
                                                        RT_ICON0x16e6f80xf255PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                                        RT_GROUP_ICON0x17d9600x5adata
                                                        RT_VERSION0x17d9cc0x3cedata
                                                        RT_MANIFEST0x17ddac0x5daXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                        Imports

                                                        DLLImport
                                                        mscoree.dll_CorExeMain

                                                        Version Infos

                                                        DescriptionData
                                                        Translation0x0000 0x04b0
                                                        LegalCopyrightCopyright 2015 Benz
                                                        Assembly Version1.6.0.65
                                                        InternalNameTopLevelAssemblyTypeResolver.exe
                                                        FileVersion1.6.0.65
                                                        CompanyNameTown and Country Convenience Stores
                                                        LegalTrademarks
                                                        Comments
                                                        ProductNameCDWorkFlow
                                                        ProductVersion1.6.0.65
                                                        FileDescriptionCDWorkFlow
                                                        OriginalFilenameTopLevelAssemblyTypeResolver.exe

                                                        Network Behavior

                                                        Network Port Distribution

                                                        TCP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Jun 11, 2021 10:35:53.319247961 CEST49777587192.168.2.4173.249.158.24
                                                        Jun 11, 2021 10:35:53.473428011 CEST58749777173.249.158.24192.168.2.4
                                                        Jun 11, 2021 10:35:53.473726988 CEST49777587192.168.2.4173.249.158.24
                                                        Jun 11, 2021 10:35:53.879920959 CEST58749777173.249.158.24192.168.2.4
                                                        Jun 11, 2021 10:35:53.880697012 CEST49777587192.168.2.4173.249.158.24
                                                        Jun 11, 2021 10:35:54.075145006 CEST58749777173.249.158.24192.168.2.4
                                                        Jun 11, 2021 10:35:54.419498920 CEST58749777173.249.158.24192.168.2.4
                                                        Jun 11, 2021 10:35:54.420450926 CEST49777587192.168.2.4173.249.158.24
                                                        Jun 11, 2021 10:35:54.575196028 CEST58749777173.249.158.24192.168.2.4
                                                        Jun 11, 2021 10:35:54.576607943 CEST58749777173.249.158.24192.168.2.4
                                                        Jun 11, 2021 10:35:54.576687098 CEST49777587192.168.2.4173.249.158.24
                                                        Jun 11, 2021 10:35:54.579893112 CEST49777587192.168.2.4173.249.158.24
                                                        Jun 11, 2021 10:35:54.733411074 CEST58749777173.249.158.24192.168.2.4

                                                        UDP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Jun 11, 2021 10:33:56.290431023 CEST5309753192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:33:56.341996908 CEST53530978.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:33:57.330971956 CEST4925753192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:33:57.386940956 CEST53492578.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:33:57.513700008 CEST6238953192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:33:57.564064026 CEST53623898.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:33:57.823036909 CEST4991053192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:33:57.877491951 CEST53499108.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:33:58.043072939 CEST5585453192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:33:58.099106073 CEST53558548.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:33:58.180588007 CEST6454953192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:33:58.230870008 CEST53645498.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:33:59.621726036 CEST6315353192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:33:59.681188107 CEST53631538.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:00.967665911 CEST5299153192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:01.017910957 CEST53529918.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:03.082721949 CEST5370053192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:03.134270906 CEST53537008.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:04.677480936 CEST5172653192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:04.736222982 CEST53517268.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:05.648658991 CEST5679453192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:05.702225924 CEST53567948.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:06.561427116 CEST5653453192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:06.621249914 CEST53565348.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:09.032438993 CEST5662753192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:09.082566977 CEST53566278.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:09.980338097 CEST5662153192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:10.031027079 CEST53566218.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:10.952074051 CEST6311653192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:11.002082109 CEST53631168.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:11.876445055 CEST6407853192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:11.926604986 CEST53640788.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:13.052963018 CEST6480153192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:13.114428043 CEST53648018.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:22.675352097 CEST6172153192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:22.736996889 CEST53617218.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:23.669648886 CEST5125553192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:23.719836950 CEST53512558.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:24.582063913 CEST6152253192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:24.635190964 CEST53615228.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:25.110411882 CEST5233753192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:25.173124075 CEST53523378.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:25.641455889 CEST5504653192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:25.703164101 CEST53550468.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:41.844541073 CEST4961253192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:41.988982916 CEST53496128.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:42.566684961 CEST4928553192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:42.576778889 CEST5060153192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:42.628413916 CEST53492858.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:42.645960093 CEST53506018.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:43.163948059 CEST6087553192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:43.316416025 CEST53608758.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:43.777223110 CEST5644853192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:43.838964939 CEST53564488.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:44.372895002 CEST5917253192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:44.434624910 CEST53591728.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:44.974304914 CEST6242053192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:45.038090944 CEST53624208.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:45.479558945 CEST6057953192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:45.539040089 CEST53605798.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:46.281991005 CEST5018353192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:46.344120026 CEST53501838.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:47.228070974 CEST6153153192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:47.287065983 CEST53615318.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:47.689727068 CEST4922853192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:47.749660969 CEST53492288.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:50.909270048 CEST5979453192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:50.968363047 CEST53597948.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:59.658808947 CEST5591653192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:59.692982912 CEST5275253192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:34:59.727289915 CEST53559168.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:34:59.743439913 CEST53527528.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:35:02.536353111 CEST6054253192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:35:02.596685886 CEST53605428.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:35:35.419301987 CEST6068953192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:35:35.493822098 CEST53606898.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:35:37.047209024 CEST6420653192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:35:37.106333971 CEST53642068.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:35:52.829802990 CEST5090453192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:35:53.027034044 CEST53509048.8.8.8192.168.2.4
                                                        Jun 11, 2021 10:35:53.043632030 CEST5752553192.168.2.48.8.8.8
                                                        Jun 11, 2021 10:35:53.216770887 CEST53575258.8.8.8192.168.2.4

                                                        DNS Queries

                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                        Jun 11, 2021 10:35:52.829802990 CEST192.168.2.48.8.8.80x4e11Standard query (0)mail.crigab.clA (IP address)IN (0x0001)
                                                        Jun 11, 2021 10:35:53.043632030 CEST192.168.2.48.8.8.80x3c1fStandard query (0)mail.crigab.clA (IP address)IN (0x0001)

                                                        DNS Answers

                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                        Jun 11, 2021 10:35:53.027034044 CEST8.8.8.8192.168.2.40x4e11No error (0)mail.crigab.clcrigab.clCNAME (Canonical name)IN (0x0001)
                                                        Jun 11, 2021 10:35:53.027034044 CEST8.8.8.8192.168.2.40x4e11No error (0)crigab.cl173.249.158.24A (IP address)IN (0x0001)
                                                        Jun 11, 2021 10:35:53.216770887 CEST8.8.8.8192.168.2.40x3c1fNo error (0)mail.crigab.clcrigab.clCNAME (Canonical name)IN (0x0001)
                                                        Jun 11, 2021 10:35:53.216770887 CEST8.8.8.8192.168.2.40x3c1fNo error (0)crigab.cl173.249.158.24A (IP address)IN (0x0001)

                                                        SMTP Packets

                                                        TimestampSource PortDest PortSource IPDest IPCommands
                                                        Jun 11, 2021 10:35:53.879920959 CEST58749777173.249.158.24192.168.2.4220-ww1.hechile.com ESMTP Exim 4.94.2 #2 Fri, 11 Jun 2021 04:35:53 -0400
                                                        220-We do not authorize the use of this system to transport unsolicited,
                                                        220 and/or bulk e-mail.
                                                        Jun 11, 2021 10:35:53.880697012 CEST49777587192.168.2.4173.249.158.24EHLO 494126
                                                        Jun 11, 2021 10:35:54.419498920 CEST58749777173.249.158.24192.168.2.4250-ww1.hechile.com Hello 494126 [84.17.52.18]
                                                        250-SIZE 52428800
                                                        250-8BITMIME
                                                        250-PIPELINING
                                                        250-PIPE_CONNECT
                                                        250-STARTTLS
                                                        250 HELP
                                                        Jun 11, 2021 10:35:54.420450926 CEST49777587192.168.2.4173.249.158.24MAIL FROM:<jaime.navarro@crigab.cl>
                                                        Jun 11, 2021 10:35:54.575196028 CEST58749777173.249.158.24192.168.2.4550 Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

                                                        Code Manipulations

                                                        Statistics

                                                        Behavior

                                                        Click to jump to process

                                                        System Behavior

                                                        General

                                                        Start time:10:34:00
                                                        Start date:11/06/2021
                                                        Path:C:\Users\user\Desktop\Minutes of meeting June 9th.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:'C:\Users\user\Desktop\Minutes of meeting June 9th.exe'
                                                        Imagebase:0x250000
                                                        File size:1552896 bytes
                                                        MD5 hash:EE4B5D2D220B8B925A84755E5AD9FA06
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:.Net C# or VB.NET
                                                        Yara matches:
                                                        • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.671554709.0000000002830000.00000004.00000001.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.671900306.00000000037E1000.00000004.00000001.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.671900306.00000000037E1000.00000004.00000001.sdmp, Author: Joe Security
                                                        Reputation:low

                                                        General

                                                        Start time:10:34:10
                                                        Start date:11/06/2021
                                                        Path:C:\Windows\SysWOW64\schtasks.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\RfuYgTevtBVukb' /XML 'C:\Users\user\AppData\Local\Temp\tmp1C49.tmp'
                                                        Imagebase:0x2d0000
                                                        File size:185856 bytes
                                                        MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high

                                                        General

                                                        Start time:10:34:10
                                                        Start date:11/06/2021
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff724c50000
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high

                                                        General

                                                        Start time:10:34:11
                                                        Start date:11/06/2021
                                                        Path:C:\Users\user\Desktop\Minutes of meeting June 9th.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:C:\Users\user\Desktop\Minutes of meeting June 9th.exe
                                                        Imagebase:0x960000
                                                        File size:1552896 bytes
                                                        MD5 hash:EE4B5D2D220B8B925A84755E5AD9FA06
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:.Net C# or VB.NET
                                                        Yara matches:
                                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.909165017.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000002.909165017.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000000.668170941.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000000.668170941.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.910886849.00000000030B1000.00000004.00000001.sdmp, Author: Joe Security
                                                        Reputation:low

                                                        Disassembly

                                                        Code Analysis

                                                        Reset < >