Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Windows Analysis Report IN00043Q1098157INBOM_PDF.scr

Overview

General Information

Sample Name:IN00043Q1098157INBOM_PDF.scr (renamed file extension from scr to exe)
Analysis ID:483913
MD5:c2ce5a6ac6a3f64917af0f6ea60c04e5
SHA1:4f04822fbc2e6c2cbcd529ffbf13fe0e69d0ef8b
SHA256:4220609cfa7ee56eb45421d8c08257f828c06bb8ebf0bc602cff01609107c6c4
Tags:agentteslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:80
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Yara detected AgentTesla
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Binary contains a suspicious time stamp
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Dropped file seen in connection with other malware
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • IN00043Q1098157INBOM_PDF.exe (PID: 6352 cmdline: 'C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exe' MD5: C2CE5A6AC6A3F64917AF0F6EA60C04E5)
    • powershell.exe (PID: 6652 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Start-Sleep -s 20 MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 6676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • aspnet_compiler.exe (PID: 5364 cmdline: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe MD5: 17CC69238395DF61AAF483BCEF02E7C9)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "z6@pa-ksa.com", "Password": "7mgTt7HCBo3_tl@", "Host": "secure300.inmotionhosting.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.441498436.00000000031FD000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000000.00000002.441498436.00000000031FD000.00000004.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      0000001B.00000002.486860969.0000000002ED1000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        0000001B.00000002.486860969.0000000002ED1000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          0000001B.00000002.481444903.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 10 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.IN00043Q1098157INBOM_PDF.exe.42ef140.11.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              0.2.IN00043Q1098157INBOM_PDF.exe.42ef140.11.raw.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                27.2.aspnet_compiler.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  27.2.aspnet_compiler.exe.400000.0.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    0.2.IN00043Q1098157INBOM_PDF.exe.43a3ce8.12.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 9 entries

                      Sigma Overview

                      System Summary:

                      barindex
                      Sigma detected: Non Interactive PowerShellShow sources
                      Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Start-Sleep -s 20, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Start-Sleep -s 20, CommandLine|base64offset|contains: Jy, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exe' , ParentImage: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exe, ParentProcessId: 6352, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Start-Sleep -s 20, ProcessId: 6652
                      Sigma detected: T1086 PowerShell ExecutionShow sources
                      Source: Pipe createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132762211537809114.6652.DefaultAppDomain.powershell

                      Jbx Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 0.2.IN00043Q1098157INBOM_PDF.exe.43f3d08.14.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "z6@pa-ksa.com", "Password": "7mgTt7HCBo3_tl@", "Host": "secure300.inmotionhosting.com"}
                      Machine Learning detection for sampleShow sources
                      Source: IN00043Q1098157INBOM_PDF.exeJoe Sandbox ML: detected
                      Source: 27.2.aspnet_compiler.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: IN00043Q1098157INBOM_PDF.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: IN00043Q1098157INBOM_PDF.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdb source: IN00043Q1098157INBOM_PDF.exe
                      Source: Binary string: aspnet_compiler.pdb source: aspnet_compiler.exe, aspnet_compiler.exe.0.dr
                      Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdbSHA256/ source: IN00043Q1098157INBOM_PDF.exe
                      Source: aspnet_compiler.exe, 0000001B.00000002.486860969.0000000002ED1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: aspnet_compiler.exe, 0000001B.00000002.486860969.0000000002ED1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: aspnet_compiler.exe, 0000001B.00000002.486860969.0000000002ED1000.00000004.00000001.sdmpString found in binary or memory: http://ISXesm.com
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: http://james.newtonking.com/projects/json
                      Source: powershell.exe, 00000004.00000002.349654412.00000000057D2000.00000004.00000001.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: http://ocsp.digicert.com0C
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: http://ocsp.digicert.com0K
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: http://ocsp.digicert.com0N
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: http://ocsp.digicert.com0O
                      Source: powershell.exe, 00000004.00000002.350935626.0000000007773000.00000004.00000001.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                      Source: powershell.exe, 00000004.00000002.346116296.00000000048B2000.00000004.00000001.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.pngH
                      Source: powershell.exe, 00000004.00000002.345882415.0000000004771000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: powershell.exe, 00000004.00000002.350935626.0000000007773000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                      Source: powershell.exe, 00000004.00000002.346116296.00000000048B2000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlH
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.437566275.0000000006050000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224188494.0000000006096000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224137907.0000000006096000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.html:3
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.440850247.0000000001867000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.com/designersa6
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224277676.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comX
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224277676.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.coma4
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224277676.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comalic
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224783246.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comd
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.437566275.0000000006050000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.come.com
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.437566275.0000000006050000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comiona
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224277676.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comituF-
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224783246.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comituFQ
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224783246.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comitud
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224783246.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comt
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.219288579.0000000006057000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.226033077.0000000006057000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.226033077.0000000006057000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/n
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.220902698.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp//
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.220902698.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/2
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/4
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221601834.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/C
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221601834.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Q
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221601834.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0-
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221601834.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/4
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/k
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221601834.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/n
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/oH
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221601834.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/oi
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/vnoJ
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/waC
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: powershell.exe, 00000004.00000002.349654412.00000000057D2000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/
                      Source: powershell.exe, 00000004.00000002.349654412.00000000057D2000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/Icon
                      Source: powershell.exe, 00000004.00000002.349654412.00000000057D2000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/License
                      Source: powershell.exe, 00000004.00000002.350935626.0000000007773000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Pester/Pester
                      Source: powershell.exe, 00000004.00000002.346116296.00000000048B2000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Pester/PesterH
                      Source: powershell.exe, 00000004.00000002.349199494.0000000004FEB000.00000004.00000001.sdmpString found in binary or memory: https://go.micro
                      Source: powershell.exe, 00000004.00000002.349654412.00000000057D2000.00000004.00000001.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: https://www.digicert.com/CPS0
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: https://www.newtonsoft.com/json
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: https://www.newtonsoft.com/jsonschema
                      Source: IN00043Q1098157INBOM_PDF.exeString found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.441498436.00000000031FD000.00000004.00000001.sdmp, aspnet_compiler.exe, 0000001B.00000002.481444903.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: aspnet_compiler.exe, 0000001B.00000002.486860969.0000000002ED1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.438643894.00000000013E8000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

                      System Summary:

                      barindex
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: IN00043Q1098157INBOM_PDF.exe
                      Source: IN00043Q1098157INBOM_PDF.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeCode function: 0_2_00D52050
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeCode function: 0_2_0162C134
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeCode function: 0_2_0162E568
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeCode function: 0_2_0162E578
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeCode function: 0_2_00D56F3F
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeCode function: 0_2_00D55DE2
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_04750858
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_07858DE0
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_07850014
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_07850040
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeCode function: 27_2_053B46E0
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeCode function: 27_2_053B4650
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeCode function: 27_2_053B4692
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeCode function: 27_2_053B46D2
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeCode function: 27_2_053BD350
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeCode function: 27_2_061A7530
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeCode function: 27_2_061A90F0
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeCode function: 27_2_061A6918
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeCode function: 27_2_061A6C60
                      Source: IN00043Q1098157INBOM_PDF.exeBinary or memory string: OriginalFilename vs IN00043Q1098157INBOM_PDF.exe
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.439411203.0000000001530000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameGexjantftnrclnlpo.dllD vs IN00043Q1098157INBOM_PDF.exe
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.441498436.00000000031FD000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameBqppZujFnZRDUhZjEPpNfXEpLZgMl.exe4 vs IN00043Q1098157INBOM_PDF.exe
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.438643894.00000000013E8000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs IN00043Q1098157INBOM_PDF.exe
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.442249065.0000000004191000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameAtexwtottfz.dll" vs IN00043Q1098157INBOM_PDF.exe
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000000.213953537.0000000000D52000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs IN00043Q1098157INBOM_PDF.exe
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000000.213953537.0000000000D52000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameSSGG1.exe: vs IN00043Q1098157INBOM_PDF.exe
                      Source: IN00043Q1098157INBOM_PDF.exeBinary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs IN00043Q1098157INBOM_PDF.exe
                      Source: IN00043Q1098157INBOM_PDF.exeBinary or memory string: OriginalFilenameSSGG1.exe: vs IN00043Q1098157INBOM_PDF.exe
                      Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe A1661DB1B74B876A7E789FC6EBB4E34BEAFA2B48A08E13FD18927FBECC9D2AC4
                      Source: IN00043Q1098157INBOM_PDF.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: unknownProcess created: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exe 'C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exe'
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Start-Sleep -s 20
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess created: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Start-Sleep -s 20
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess created: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IN00043Q1098157INBOM_PDF.exe.logJump to behavior
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeFile created: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeJump to behavior
                      Source: classification engineClassification label: mal80.troj.evad.winEXE@6/7@0/0
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6676:120:WilError_01
                      Source: Window RecorderWindow detected: More than 3 window changes detected
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                      Source: IN00043Q1098157INBOM_PDF.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: IN00043Q1098157INBOM_PDF.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: IN00043Q1098157INBOM_PDF.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdb source: IN00043Q1098157INBOM_PDF.exe
                      Source: Binary string: aspnet_compiler.pdb source: aspnet_compiler.exe, aspnet_compiler.exe.0.dr
                      Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdbSHA256/ source: IN00043Q1098157INBOM_PDF.exe
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeCode function: 27_2_061A7EFA push 8BF04589h; iretd
                      Source: IN00043Q1098157INBOM_PDF.exeStatic PE information: 0xBA8C4F5A [Wed Mar 6 01:05:30 2069 UTC]
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.06744291098
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeFile created: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeJump to dropped file
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion:

                      barindex
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exe TID: 6356Thread sleep time: -34000s >= -30000s
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exe TID: 6388Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5592Thread sleep time: -2767011611056431s >= -30000s
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6808Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 6524Thread sleep time: -10145709240540247s >= -30000s
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 6496Thread sleep count: 284 > 30
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe TID: 6496Thread sleep count: 9581 > 30
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2062
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1443
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeWindow / User API: threadDelayed 9581
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess information queried: ProcessInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeThread delayed: delay time: 922337203685477
                      Source: powershell.exe, 00000004.00000002.347257927.0000000004BB2000.00000004.00000001.sdmpBinary or memory string: Hyper-V
                      Source: powershell.exe, 00000004.00000002.347257927.0000000004BB2000.00000004.00000001.sdmpBinary or memory string: i:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.438821139.0000000001421000.00000004.00000020.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                      Source: IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.438821139.0000000001421000.00000004.00000020.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess token adjusted: Debug
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeMemory allocated: page read and write | page guard
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Start-Sleep -s 20
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeProcess created: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe
                      Source: aspnet_compiler.exe, 0000001B.00000002.485882884.00000000019C0000.00000002.00020000.sdmpBinary or memory string: Program Manager
                      Source: aspnet_compiler.exe, 0000001B.00000002.485882884.00000000019C0000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
                      Source: aspnet_compiler.exe, 0000001B.00000002.485882884.00000000019C0000.00000002.00020000.sdmpBinary or memory string: Progman
                      Source: aspnet_compiler.exe, 0000001B.00000002.485882884.00000000019C0000.00000002.00020000.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exe VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeQueries volume information: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                      Source: C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
                      Source: C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeCode function: 27_2_061A63F4 GetUserNameW,

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 0.2.IN00043Q1098157INBOM_PDF.exe.42ef140.11.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 27.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.IN00043Q1098157INBOM_PDF.exe.43a3ce8.12.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.IN00043Q1098157INBOM_PDF.exe.43f3d08.14.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.IN00043Q1098157INBOM_PDF.exe.43f3d08.14.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.IN00043Q1098157INBOM_PDF.exe.43a3ce8.12.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.IN00043Q1098157INBOM_PDF.exe.437bcc8.13.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000000.00000002.441498436.00000000031FD000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001B.00000002.481444903.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.442771360.00000000043F3000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.442693182.0000000004363000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.442575093.00000000042EF000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001B.00000002.486860969.0000000002ED1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: IN00043Q1098157INBOM_PDF.exe PID: 6352, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: aspnet_compiler.exe PID: 5364, type: MEMORYSTR
                      Source: Yara matchFile source: 0000001B.00000002.486860969.0000000002ED1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: aspnet_compiler.exe PID: 5364, type: MEMORYSTR

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 0.2.IN00043Q1098157INBOM_PDF.exe.42ef140.11.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 27.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.IN00043Q1098157INBOM_PDF.exe.43a3ce8.12.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.IN00043Q1098157INBOM_PDF.exe.43f3d08.14.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.IN00043Q1098157INBOM_PDF.exe.43f3d08.14.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.IN00043Q1098157INBOM_PDF.exe.43a3ce8.12.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.IN00043Q1098157INBOM_PDF.exe.437bcc8.13.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000000.00000002.441498436.00000000031FD000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001B.00000002.481444903.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.442771360.00000000043F3000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.442693182.0000000004363000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.442575093.00000000042EF000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000001B.00000002.486860969.0000000002ED1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: IN00043Q1098157INBOM_PDF.exe PID: 6352, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: aspnet_compiler.exe PID: 5364, type: MEMORYSTR

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211Path InterceptionProcess Injection12Masquerading1Input Capture1Security Software Discovery111Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemoryProcess Discovery2Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion131Security Account ManagerVirtualization/Sandbox Evasion131SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection12NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information2LSA SecretsAccount Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonSoftware Packing2Cached Domain CredentialsSystem Owner/User Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsTimestomp1DCSyncFile and Directory Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemSystem Information Discovery113Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      IN00043Q1098157INBOM_PDF.exe100%Joe Sandbox ML

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe3%MetadefenderBrowse
                      C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe0%ReversingLabs

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      27.2.aspnet_compiler.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File

                      Domains

                      No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      https://contoso.com/License0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/jp/40%Avira URL Cloudsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.fontbureau.comiona0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://www.galapagosdesign.com/n0%Avira URL Cloudsafe
                      http://www.jiyu-kobo.co.jp/40%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/20%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp//0%URL Reputationsafe
                      https://contoso.com/0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      http://www.galapagosdesign.com/0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/Q0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/waC0%Avira URL Cloudsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://go.micro0%URL Reputationsafe
                      http://www.fontbureau.comituF-0%Avira URL Cloudsafe
                      https://contoso.com/Icon0%URL Reputationsafe
                      http://www.fontbureau.comX0%Avira URL Cloudsafe
                      http://www.jiyu-kobo.co.jp/C0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/oi0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
                      http://www.fontbureau.comd0%URL Reputationsafe
                      http://www.fontbureau.come.com0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/vnoJ0%Avira URL Cloudsafe
                      http://james.newtonking.com/projects/json0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.fontbureau.comt0%URL Reputationsafe
                      http://pesterbdd.com/images/Pester.pngH0%Avira URL Cloudsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/n0%URL Reputationsafe
                      http://www.fontbureau.coma40%Avira URL Cloudsafe
                      http://www.jiyu-kobo.co.jp/Y0-0%Avira URL Cloudsafe
                      http://www.jiyu-kobo.co.jp/k0%URL Reputationsafe
                      http://www.fontbureau.comituFQ0%Avira URL Cloudsafe
                      http://www.fontbureau.comalic0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/oH0%Avira URL Cloudsafe
                      http://ISXesm.com0%Avira URL Cloudsafe
                      http://www.fontbureau.comitud0%URL Reputationsafe

                      Domains and IPs

                      Contacted Domains

                      No contacted domains info

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://127.0.0.1:HTTP/1.1aspnet_compiler.exe, 0000001B.00000002.486860969.0000000002ED1000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		low
                      http://www.fontbureau.com/designersGIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                        		high
                        http://www.fontbureau.com/designers/?IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                          		high
                          http://www.founder.com.cn/cn/bTheIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designers?IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                            		high
                            https://github.com/Pester/PesterHpowershell.exe, 00000004.00000002.346116296.00000000048B2000.00000004.00000001.sdmpfalse
                              		high
                              https://contoso.com/Licensepowershell.exe, 00000004.00000002.349654412.00000000057D2000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.tiro.comIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              https://www.newtonsoft.com/jsonIN00043Q1098157INBOM_PDF.exefalse
                                		high
                                http://www.fontbureau.com/designersIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                  		high
                                  http://www.jiyu-kobo.co.jp/jp/4IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221601834.0000000006056000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.goodfont.co.krIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.com/designersa6IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.440850247.0000000001867000.00000004.00000040.sdmpfalse
                                    		high
                                    http://www.fontbureau.comionaIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.437566275.0000000006050000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.sajatypeworks.comIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.typography.netDIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.founder.com.cn/cn/cTheIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.galapagosdesign.com/staff/dennis.htmIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://fontfabrik.comIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.galapagosdesign.com/nIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.226033077.0000000006057000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.jiyu-kobo.co.jp/4IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.jiyu-kobo.co.jp/2IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.220902698.0000000006056000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.jiyu-kobo.co.jp//IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.220902698.0000000006056000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://contoso.com/powershell.exe, 00000004.00000002.349654412.00000000057D2000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://nuget.org/nuget.exepowershell.exe, 00000004.00000002.349654412.00000000057D2000.00000004.00000001.sdmpfalse
                                      		high
                                      http://www.galapagosdesign.com/DPleaseIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.jiyu-kobo.co.jp/Y0IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fonts.comIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                        		high
                                        http://www.sandoll.co.krIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.urwpp.deDPleaseIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.zhongyicts.com.cnIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000004.00000002.345882415.0000000004771000.00000004.00000001.sdmpfalse
                                          		high
                                          http://www.sakkal.comIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.441498436.00000000031FD000.00000004.00000001.sdmp, aspnet_compiler.exe, 0000001B.00000002.481444903.0000000000402000.00000040.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://nuget.org/NuGet.exepowershell.exe, 00000004.00000002.349654412.00000000057D2000.00000004.00000001.sdmpfalse
                                            		high
                                            http://www.apache.org/licenses/LICENSE-2.0IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                              		high
                                              http://www.fontbureau.comIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.437566275.0000000006050000.00000004.00000001.sdmpfalse
                                                		high
                                                http://www.galapagosdesign.com/IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.226033077.0000000006057000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://DynDns.comDynDNSaspnet_compiler.exe, 0000001B.00000002.486860969.0000000002ED1000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000004.00000002.350935626.0000000007773000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.jiyu-kobo.co.jp/QIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221601834.0000000006056000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.jiyu-kobo.co.jp/waCIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haaspnet_compiler.exe, 0000001B.00000002.486860969.0000000002ED1000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000004.00000002.350935626.0000000007773000.00000004.00000001.sdmpfalse
                                                  		high
                                                  https://go.micropowershell.exe, 00000004.00000002.349199494.0000000004FEB000.00000004.00000001.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.fontbureau.comituF-IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224277676.0000000006056000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		low
                                                  http://www.apache.org/licenses/LICENSE-2.0.htmlHpowershell.exe, 00000004.00000002.346116296.00000000048B2000.00000004.00000001.sdmpfalse
                                                    		high
                                                    https://contoso.com/Iconpowershell.exe, 00000004.00000002.349654412.00000000057D2000.00000004.00000001.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://www.fontbureau.comXIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224277676.0000000006056000.00000004.00000001.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.jiyu-kobo.co.jp/CIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221601834.0000000006056000.00000004.00000001.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://www.jiyu-kobo.co.jp/oiIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221601834.0000000006056000.00000004.00000001.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://www.jiyu-kobo.co.jp/jp/IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://www.fontbureau.comdIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224783246.0000000006056000.00000004.00000001.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://www.fontbureau.come.comIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.437566275.0000000006050000.00000004.00000001.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://www.jiyu-kobo.co.jp/vnoJIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://github.com/Pester/Pesterpowershell.exe, 00000004.00000002.350935626.0000000007773000.00000004.00000001.sdmpfalse
                                                      		high
                                                      http://james.newtonking.com/projects/jsonIN00043Q1098157INBOM_PDF.exefalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://www.carterandcone.comlIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://www.fontbureau.com/designers/cabarga.htmlNIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                                        		high
                                                        http://www.founder.com.cn/cnIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.219288579.0000000006057000.00000004.00000001.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.fontbureau.com/designers/frere-jones.htmlIN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                                          		high
                                                          http://www.fontbureau.com/designers/cabarga.htmlIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224188494.0000000006096000.00000004.00000001.sdmpfalse
                                                            		high
                                                            http://www.fontbureau.comtIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224783246.0000000006056000.00000004.00000001.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            http://pesterbdd.com/images/Pester.pngHpowershell.exe, 00000004.00000002.346116296.00000000048B2000.00000004.00000001.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            http://www.jiyu-kobo.co.jp/IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            http://www.jiyu-kobo.co.jp/nIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221601834.0000000006056000.00000004.00000001.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://www.newtonsoft.com/jsonschemaIN00043Q1098157INBOM_PDF.exefalse
                                                              		high
                                                              http://www.fontbureau.coma4IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224277676.0000000006056000.00000004.00000001.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              http://www.jiyu-kobo.co.jp/Y0-IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221601834.0000000006056000.00000004.00000001.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              http://www.jiyu-kobo.co.jp/kIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              http://www.fontbureau.com/designers8IN00043Q1098157INBOM_PDF.exe, 00000000.00000002.444190384.0000000007262000.00000004.00000001.sdmpfalse
                                                                		high
                                                                http://www.fontbureau.comituFQIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224783246.0000000006056000.00000004.00000001.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://www.nuget.org/packages/Newtonsoft.Json.BsonIN00043Q1098157INBOM_PDF.exefalse
                                                                  		high
                                                                  http://www.fontbureau.com/designers/cabarga.html:3IN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224137907.0000000006096000.00000004.00000001.sdmpfalse
                                                                    		high
                                                                    http://www.fontbureau.comalicIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224277676.0000000006056000.00000004.00000001.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    http://www.jiyu-kobo.co.jp/oHIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.221278628.0000000006056000.00000004.00000001.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://ISXesm.comaspnet_compiler.exe, 0000001B.00000002.486860969.0000000002ED1000.00000004.00000001.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://www.fontbureau.comitudIN00043Q1098157INBOM_PDF.exe, 00000000.00000003.224783246.0000000006056000.00000004.00000001.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    		unknown

                                                                    Contacted IPs

                                                                    No contacted IP infos

                                                                    General Information

                                                                    Joe Sandbox Version:33.0.0 White Diamond
                                                                    Analysis ID:483913
                                                                    Start date:15.09.2021
                                                                    Start time:16:11:31
                                                                    Joe Sandbox Product:CloudBasic
                                                                    Overall analysis duration:0h 10m 31s
                                                                    Hypervisor based Inspection enabled:false
                                                                    Report type:light
                                                                    Sample file name:IN00043Q1098157INBOM_PDF.scr (renamed file extension from scr to exe)
                                                                    Cookbook file name:default.jbs
                                                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                    Number of analysed new started processes analysed:29
                                                                    Number of new started drivers analysed:0
                                                                    Number of existing processes analysed:0
                                                                    Number of existing drivers analysed:0
                                                                    Number of injected processes analysed:0
                                                                    Technologies:
                                                                    • HCA enabled
                                                                    • EGA enabled
                                                                    • HDC enabled
                                                                    • AMSI enabled
                                                                    Analysis Mode:default
                                                                    Analysis stop reason:Timeout
                                                                    Detection:MAL
                                                                    Classification:mal80.troj.evad.winEXE@6/7@0/0
                                                                    EGA Information:Failed
                                                                    HDC Information:
                                                                    • Successful, ratio: 0.1% (good quality ratio 0.1%)
                                                                    • Quality average: 61.4%
                                                                    • Quality standard deviation: 22.4%
                                                                    HCA Information:
                                                                    • Successful, ratio: 100%
                                                                    • Number of executed functions: 0
                                                                    • Number of non-executed functions: 0
                                                                    Cookbook Comments:
                                                                    • Adjust boot time
                                                                    • Enable AMSI
                                                                    Warnings:
                                                                    Show All
                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, UsoClient.exe
                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                    • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                                    • VT rate limit hit for: /opt/package/joesandbox/database/analysis/483913/sample/IN00043Q1098157INBOM_PDF.exe

                                                                    Simulations

                                                                    Behavior and APIs

                                                                    TimeTypeDescription
                                                                    16:12:56API Interceptor27x Sleep call for process: powershell.exe modified
                                                                    16:14:22API Interceptor63x Sleep call for process: aspnet_compiler.exe modified

                                                                    Joe Sandbox View / Context

                                                                    IPs

                                                                    No context

                                                                    Domains

                                                                    No context

                                                                    ASN

                                                                    No context

                                                                    JA3 Fingerprints

                                                                    No context

                                                                    Dropped Files

                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                    C:\Users\user\AppData\Local\Temp\aspnet_compiler.exeHSBC Payment Advice_Docx.exeGet hashmaliciousBrowse
                                                                      HSBC Payment Advice_Docx.exeGet hashmaliciousBrowse
                                                                        Shipping Doc_09092021_Docx.exeGet hashmaliciousBrowse
                                                                          Shipping Doc_09092021_Docx.exeGet hashmaliciousBrowse
                                                                            usfive_20210827-130539.exeGet hashmaliciousBrowse
                                                                              f00tY8HNIM.exeGet hashmaliciousBrowse

                                                                                Created / dropped Files

                                                                                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IN00043Q1098157INBOM_PDF.exe.log
                                                                                Process:C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exe
                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                Category:dropped
                                                                                Size (bytes):1119
                                                                                Entropy (8bit):5.356708753875314
                                                                                Encrypted:false
                                                                                SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzd
                                                                                MD5:3197B1D4714B56F2A6AC9E83761739AE
                                                                                SHA1:3B38010F0DF51C1D4D2C020138202DABB686741D
                                                                                SHA-256:40586572180B85042FEFED9F367B43831C5D269751D9F3940BBC29B41E18E9F6
                                                                                SHA-512:58EC975A53AD9B19B425F6C6843A94CC280F794D436BBF3D29D8B76CA1E8C2D8883B3E754F9D4F2C9E9387FE88825CCD9919369A5446B1AFF73EDBE07FA94D88
                                                                                Malicious:true
                                                                                Reputation:moderate, very likely benign file
                                                                                Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21
                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):5829
                                                                                Entropy (8bit):4.8968676994158
                                                                                Encrypted:false
                                                                                SSDEEP:96:WCJ2Woe5o2k6Lm5emmXIGvgyg12jDs+un/iQLEYFjDaeWJ6KGcmXx9smyFRLcU6f:5xoe5oVsm5emd0gkjDt4iWN3yBGHh9s6
                                                                                MD5:36DE9155D6C265A1DE62A448F3B5B66E
                                                                                SHA1:02D21946CBDD01860A0DE38D7EEC6CDE3A964FC3
                                                                                SHA-256:8BA38D55AA8F1E4F959E7223FDF653ABB9BE5B8B5DE9D116604E1ABB371C1C87
                                                                                SHA-512:C734ADE161FB89472B1DF9B9F062F4A53E7010D3FF99EDC0BD564540A56BC35743625C50A00635C31D165A74DCDBB330FFB878C5919D7B267F6F33D2AAB328E7
                                                                                Malicious:false
                                                                                Reputation:moderate, very likely benign file
                                                                                Preview: PSMODULECACHE......<.e...Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........<.e...T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....
                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):17204
                                                                                Entropy (8bit):5.560276111592368
                                                                                Encrypted:false
                                                                                SSDEEP:384:8t9/k03Y+V8RL75aCBjSBKnskt7Y9gbpkcQp7TDqYKy:wYB975H4KskFSRVDjd
                                                                                MD5:A19B43840D689BA05B91B5524BE62CE3
                                                                                SHA1:810E693A98FA202128C82EF363788F805C0A4FD8
                                                                                SHA-256:54EA1EDA2F522B6B98DF5AA260FEC6B3824C4B757B1BA0D5B480205E4DF67A3A
                                                                                SHA-512:BF39C5FB3D782AD03BF4B099B8EF045368806FB79C777D3B1A2B94CA2CD4D6D0FD2A258F6F67CB212E688E7189F059CAF12AB9239C8315F94A85CB5E2E9486D1
                                                                                Malicious:false
                                                                                Reputation:low
                                                                                Preview: @...e...................................+............@..........H...............<@.^.L."My...:'..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)S.......System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins
                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fgnvkgj4.fxf.psm1
                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:very short file (no magic)
                                                                                Category:dropped
                                                                                Size (bytes):1
                                                                                Entropy (8bit):0.0
                                                                                Encrypted:false
                                                                                SSDEEP:3:U:U
                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                Malicious:false
                                                                                Reputation:high, very likely benign file
                                                                                Preview: 1
                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqkugb4c.xqt.ps1
                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:very short file (no magic)
                                                                                Category:dropped
                                                                                Size (bytes):1
                                                                                Entropy (8bit):0.0
                                                                                Encrypted:false
                                                                                SSDEEP:3:U:U
                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                Malicious:false
                                                                                Preview: 1
                                                                                C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe
                                                                                Process:C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exe
                                                                                File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                Category:dropped
                                                                                Size (bytes):55400
                                                                                Entropy (8bit):6.093991957600089
                                                                                Encrypted:false
                                                                                SSDEEP:768:kF9E8FLLs2Zokf85dImTg6Iq88nqf7PpjU/VifNL45bO:kfE6EkfOdImT/9KU/Vot45bO
                                                                                MD5:17CC69238395DF61AAF483BCEF02E7C9
                                                                                SHA1:B164C5DC95EBCC9ECB305E43789B57E7895781DE
                                                                                SHA-256:A1661DB1B74B876A7E789FC6EBB4E34BEAFA2B48A08E13FD18927FBECC9D2AC4
                                                                                SHA-512:308CC2AB766D2233E5F5F16EF0751C525BA3017C8A4D5177E2FF1A23CD12BAD4F43DADF01139CA163951916145C2F9465A9FA50D50A365AB86942FE55B916087
                                                                                Malicious:true
                                                                                Antivirus:
                                                                                • Antivirus: Metadefender, Detection: 3%, Browse
                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                Joe Sandbox View:
                                                                                • Filename: HSBC Payment Advice_Docx.exe, Detection: malicious, Browse
                                                                                • Filename: HSBC Payment Advice_Docx.exe, Detection: malicious, Browse
                                                                                • Filename: Shipping Doc_09092021_Docx.exe, Detection: malicious, Browse
                                                                                • Filename: Shipping Doc_09092021_Docx.exe, Detection: malicious, Browse
                                                                                • Filename: usfive_20210827-130539.exe, Detection: malicious, Browse
                                                                                • Filename: f00tY8HNIM.exe, Detection: malicious, Browse
                                                                                Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.Z..............0................. ........@.. ....................................`.................................t...O.......................h>..........<................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......t3..pc.............X...<........................................0..........s.....Y.....(.....Z.....&..(......+....(....o......r...p(....-..r...p(....,.....X....i2..-;(....(..........%.r!..p.(....(....((...(....(....(....( .....-.(7...(.....*.(....-..*.~S...-.~R....S...s!.....~W...o"....~U...o#....~V...o$....o%...~Y...o&...~S...~Q...~T....s'....P...~P...sE...o(............~W....@_,s.....()...r7..p.$(*........o+..........o,....2....... ....37(....(8.........%...o-....
                                                                                C:\Users\user\Documents\20210915\PowerShell_transcript.358075.FUDbQnjY.20210915161236.txt
                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                                                Category:dropped
                                                                                Size (bytes):939
                                                                                Entropy (8bit):5.025468145438514
                                                                                Encrypted:false
                                                                                SSDEEP:24:BxSAGCxvBnOx2DOXUWM1W5HjeTKKjX4CIym1ZJXqnxSAZo:BZ9vhOoOZ5qDYB1ZWZZo
                                                                                MD5:5F60D560F07A32B8050BB12CC13DBE51
                                                                                SHA1:005A9FC94FBF972E7BFFC47764C5336748FF13ED
                                                                                SHA-256:C44DB9F1B63F63AB583E471EC83BD5D3D6071E333B5725E3CF1AFB640460AE8E
                                                                                SHA-512:B61617DF3805FC07CB428C0C2EDBC1A1487F78CB29A03C242A14E4FD172F77DC12E8A741EF364C43EC1729CA91630093BCB63A26744B764C3A6B25FF47FBF9CB
                                                                                Malicious:false
                                                                                Preview: .**********************..Windows PowerShell transcript start..Start time: 20210915161252..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 358075 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 20..Process ID: 6652..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20210915161252..**********************..PS>Start-Sleep -s 20..**********************..Command start time: 20210915161645..**********************..PS>$global:?..True..**********************..Windows PowerShell transcript end..End time: 20210915161645..**********************..

                                                                                Static File Info

                                                                                General

                                                                                File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                Entropy (8bit):7.059045468414658
                                                                                TrID:
                                                                                • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                                • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                                • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                • DOS Executable Generic (2002/1) 0.01%
                                                                                File name:IN00043Q1098157INBOM_PDF.exe
                                                                                File size:811520
                                                                                MD5:c2ce5a6ac6a3f64917af0f6ea60c04e5
                                                                                SHA1:4f04822fbc2e6c2cbcd529ffbf13fe0e69d0ef8b
                                                                                SHA256:4220609cfa7ee56eb45421d8c08257f828c06bb8ebf0bc602cff01609107c6c4
                                                                                SHA512:08c815bfc1edfed6d29184269768f606ce4be9eb9965aa2af30372640e80b0440f95d4b4ba8bdea0d23730b7edeb12cdb8b680d67b4a9c6eecac2c1aaf5327c9
                                                                                SSDEEP:12288://gecNU2zqX6lUB2Ake2BHkUzFtymEranppw9PWs1kQYZ+:QDNgWUB2AkeUDzFtrErUYugYM
                                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...ZO................0......N.......1... ...@....@.. ....................................@................................

                                                                                File Icon

                                                                                Icon Hash:c88cc8c8882c54f8

                                                                                Static PE Info

                                                                                General

                                                                                Entrypoint:0x4c31a6
                                                                                Entrypoint Section:.text
                                                                                Digitally signed:false
                                                                                Imagebase:0x400000
                                                                                Subsystem:windows gui
                                                                                Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                                                DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                                                Time Stamp:0xBA8C4F5A [Wed Mar 6 01:05:30 2069 UTC]
                                                                                TLS Callbacks:
                                                                                CLR (.Net) Version:v4.0.30319
                                                                                OS Version Major:4
                                                                                OS Version Minor:0
                                                                                File Version Major:4
                                                                                File Version Minor:0
                                                                                Subsystem Version Major:4
                                                                                Subsystem Version Minor:0
                                                                                Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                Entrypoint Preview

                                                                                Instruction
                                                                                jmp dword ptr [00402000h]
                                                                                add dword ptr [edx], eax
                                                                                add eax, dword ptr [00080706h+eax]
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al
                                                                                add byte ptr [eax], al

                                                                                Data Directories

                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0xc31540x4f.text
                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0xc40000x4ac0.rsrc
                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0xca0000xc.reloc
                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0xc31380x1c.text
                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                Sections

                                                                                NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                .text0x20000xc11b40xc1200False0.624974716828data7.06744291098IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                .rsrc0xc40000x4ac00x4c00False0.285670230263data5.10667622622IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                .reloc0xca0000xc0x200False0.044921875data0.0980041756627IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                Resources

                                                                                NameRVASizeTypeLanguageCountry
                                                                                RT_ICON0xc41000x4428dBase IV DBT of \200.DBF, blocks size 0, block length 17408, next free block index 40, next free block 0, next used block 0
                                                                                RT_GROUP_ICON0xc85380x14data
                                                                                RT_VERSION0xc855c0x362data
                                                                                RT_MANIFEST0xc88d00x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                                                Imports

                                                                                DLLImport
                                                                                mscoree.dll_CorExeMain

                                                                                Version Infos

                                                                                DescriptionData
                                                                                Translation0x0000 0x04b0
                                                                                LegalCopyrightDreamsecurity Co., Ltd.
                                                                                Assembly Version1.0.0.14
                                                                                InternalNameSSGG1.exe
                                                                                FileVersion1.0.0.14
                                                                                CompanyNameDreamsecurity
                                                                                LegalTrademarks
                                                                                CommentsMagicLine4NX
                                                                                ProductNameMagicLine4NX
                                                                                ProductVersion1.0.0.14
                                                                                FileDescriptionMagicLine4NX
                                                                                OriginalFilenameSSGG1.exe

                                                                                Network Behavior

                                                                                No network behavior found

                                                                                Code Manipulations

                                                                                Statistics

                                                                                Behavior

                                                                                Click to jump to process

                                                                                System Behavior

                                                                                Analysis Process: IN00043Q1098157INBOM_PDF.exe PID: 6352 Parent PID: 6072

                                                                                General

                                                                                Start time:16:12:24
                                                                                Start date:15/09/2021
                                                                                Path:C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exe
                                                                                Wow64 process (32bit):true
                                                                                Commandline:'C:\Users\user\Desktop\IN00043Q1098157INBOM_PDF.exe'
                                                                                Imagebase:0xd50000
                                                                                File size:811520 bytes
                                                                                MD5 hash:C2CE5A6AC6A3F64917AF0F6EA60C04E5
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:.Net C# or VB.NET
                                                                                Yara matches:
                                                                                • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.441498436.00000000031FD000.00000004.00000001.sdmp, Author: Joe Security
                                                                                • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.441498436.00000000031FD000.00000004.00000001.sdmp, Author: Joe Security
                                                                                • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.442771360.00000000043F3000.00000004.00000001.sdmp, Author: Joe Security
                                                                                • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.442771360.00000000043F3000.00000004.00000001.sdmp, Author: Joe Security
                                                                                • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.442693182.0000000004363000.00000004.00000001.sdmp, Author: Joe Security
                                                                                • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.442693182.0000000004363000.00000004.00000001.sdmp, Author: Joe Security
                                                                                • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.442575093.00000000042EF000.00000004.00000001.sdmp, Author: Joe Security
                                                                                • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.442575093.00000000042EF000.00000004.00000001.sdmp, Author: Joe Security
                                                                                Reputation:low

                                                                                Analysis Process: powershell.exe PID: 6652 Parent PID: 6352

                                                                                General

                                                                                Start time:16:12:33
                                                                                Start date:15/09/2021
                                                                                Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                Wow64 process (32bit):true
                                                                                Commandline:'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Start-Sleep -s 20
                                                                                Imagebase:0xad0000
                                                                                File size:430592 bytes
                                                                                MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:.Net C# or VB.NET
                                                                                Reputation:high

                                                                                Analysis Process: conhost.exe PID: 6676 Parent PID: 6652

                                                                                General

                                                                                Start time:16:12:34
                                                                                Start date:15/09/2021
                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                Imagebase:0x7ff6b2800000
                                                                                File size:625664 bytes
                                                                                MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high

                                                                                Analysis Process: aspnet_compiler.exe PID: 5364 Parent PID: 6352

                                                                                General

                                                                                Start time:16:14:08
                                                                                Start date:15/09/2021
                                                                                Path:C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe
                                                                                Wow64 process (32bit):true
                                                                                Commandline:C:\Users\user\AppData\Local\Temp\aspnet_compiler.exe
                                                                                Imagebase:0xb10000
                                                                                File size:55400 bytes
                                                                                MD5 hash:17CC69238395DF61AAF483BCEF02E7C9
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:.Net C# or VB.NET
                                                                                Yara matches:
                                                                                • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001B.00000002.486860969.0000000002ED1000.00000004.00000001.sdmp, Author: Joe Security
                                                                                • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000002.486860969.0000000002ED1000.00000004.00000001.sdmp, Author: Joe Security
                                                                                • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001B.00000002.481444903.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                                • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000001B.00000002.481444903.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                                Antivirus matches:
                                                                                • Detection: 3%, Metadefender, Browse
                                                                                • Detection: 0%, ReversingLabs
                                                                                Reputation:moderate

                                                                                Disassembly

                                                                                Code Analysis

                                                                                Reset < >