Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report tn9jVPvlMSqAUX5.exe

Overview

General Information

Sample Name:tn9jVPvlMSqAUX5.exe
Analysis ID:319578
MD5:afd45440cb1c77e2ebe1f2247573d04a
SHA1:36b35c3ca9db092dd6a1cf157625475fa2226e05
SHA256:babf0fe64b0415f9eaabfa1aa91f1fbed20bc21ba93f3514f18fdc298d6cb54f
Tags:ESPexegeoNanoCoreRAT

Most interesting Screenshot:

Detection

Nanocore MailPassView
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected Nanocore Rat
Malicious sample detected (through community Yara rule)
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AntiVM_3
Yara detected MailPassView
Yara detected Nanocore RAT
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected WebBrowserPassView password recovery tool
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Startup

  • System is w10x64
  • tn9jVPvlMSqAUX5.exe (PID: 6228 cmdline: 'C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe' MD5: AFD45440CB1C77E2EBE1F2247573D04A)
    • schtasks.exe (PID: 4812 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\PEcoOLaILWJ' /XML 'C:\Users\user\AppData\Local\Temp\tmpECFC.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 5108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • tn9jVPvlMSqAUX5.exe (PID: 940 cmdline: {path} MD5: AFD45440CB1C77E2EBE1F2247573D04A)
      • vbc.exe (PID: 5852 cmdline: 'c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe' /shtml 'C:\Users\user\AppData\Local\Temp\43ogpuf5.fhl' MD5: C63ED21D5706A527419C9FBD730FFB2E)
      • vbc.exe (PID: 2228 cmdline: 'c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe' /shtml 'C:\Users\user\AppData\Local\Temp\wsrpbxdq.ypo' MD5: C63ED21D5706A527419C9FBD730FFB2E)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000D.00000002.779662410.0000000000400000.00000040.00000001.sdmpJoeSecurity_WebBrowserPassViewYara detected WebBrowserPassView password recovery toolJoe Security
    00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
    • 0x24525d:$x1: NanoCore.ClientPluginHost
    • 0x24529a:$x2: IClientNetworkHost
    • 0x248dcd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
    00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmpJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
      00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmpNanoCoreunknown Kevin Breen <kevin@techanarchy.net>
      • 0x244fc5:$a: NanoCore
      • 0x244fd5:$a: NanoCore
      • 0x245209:$a: NanoCore
      • 0x24521d:$a: NanoCore
      • 0x24525d:$a: NanoCore
      • 0x245024:$b: ClientPlugin
      • 0x245226:$b: ClientPlugin
      • 0x245266:$b: ClientPlugin
      • 0x123e6f:$c: ProjectData
      • 0x24514b:$c: ProjectData
      • 0x124ba9:$d: DESCrypto
      • 0x245b52:$d: DESCrypto
      • 0x24d51e:$e: KeepAlive
      • 0x24b50c:$g: LogClientMessage
      • 0x247707:$i: get_Connected
      • 0x245e88:$j: #=q
      • 0x245eb8:$j: #=q
      • 0x245ed4:$j: #=q
      • 0x245f04:$j: #=q
      • 0x245f20:$j: #=q
      • 0x245f3c:$j: #=q
      00000000.00000002.679213235.00000000038CE000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
        Click to see the 12 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        12.2.vbc.exe.400000.0.raw.unpackJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
          12.2.vbc.exe.400000.0.unpackJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
            13.2.vbc.exe.400000.0.raw.unpackJoeSecurity_WebBrowserPassViewYara detected WebBrowserPassView password recovery toolJoe Security
              13.2.vbc.exe.400000.0.unpackJoeSecurity_WebBrowserPassViewYara detected WebBrowserPassView password recovery toolJoe Security

                Sigma Overview

                System Summary:

                barindex
                Sigma detected: NanoCoreShow sources
                Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe, ProcessId: 940, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
                Sigma detected: Scheduled temp file as task from temp locationShow sources
                Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\PEcoOLaILWJ' /XML 'C:\Users\user\AppData\Local\Temp\tmpECFC.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\PEcoOLaILWJ' /XML 'C:\Users\user\AppData\Local\Temp\tmpECFC.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe' , ParentImage: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe, ParentProcessId: 6228, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\PEcoOLaILWJ' /XML 'C:\Users\user\AppData\Local\Temp\tmpECFC.tmp', ProcessId: 4812

                Signature Overview

                Click to jump to signature section

                Show All Signature Results

                AV Detection:

                barindex
                Yara detected Nanocore RATShow sources
                Source: Yara matchFile source: 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.679941870.000000000488D000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: tn9jVPvlMSqAUX5.exe PID: 6228, type: MEMORY
                Machine Learning detection for dropped fileShow sources
                Source: C:\Users\user\AppData\Roaming\PEcoOLaILWJ.exeJoe Sandbox ML: detected
                Source: C:\Users\user\AppData\Roaming\PEcoOLaILWJ.exeJoe Sandbox ML: detected
                Machine Learning detection for sampleShow sources
                Source: tn9jVPvlMSqAUX5.exeJoe Sandbox ML: detected
                Source: tn9jVPvlMSqAUX5.exeJoe Sandbox ML: detected
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 4x nop then jmp 07D75F66h
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 4x nop then jmp 07D75F66h

                Networking:

                barindex
                Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
                Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49743 -> 23.105.131.229:4040
                Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49743 -> 23.105.131.229:4040
                Source: global trafficTCP traffic: 192.168.2.4:49737 -> 23.105.131.229:4040
                Source: global trafficTCP traffic: 192.168.2.4:49737 -> 23.105.131.229:4040
                Source: Joe Sandbox ViewASN Name: LEASEWEB-USA-NYC-11US LEASEWEB-USA-NYC-11US
                Source: Joe Sandbox ViewASN Name: LEASEWEB-USA-NYC-11US LEASEWEB-USA-NYC-11US
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.229
                Source: vbc.exe, 0000000D.00000002.779662410.0000000000400000.00000040.00000001.sdmpString found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
                Source: vbc.exe, 0000000D.00000002.779662410.0000000000400000.00000040.00000001.sdmpString found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
                Source: vbc.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
                Source: vbc.exe, 0000000D.00000003.779333133.0000000000AAE000.00000004.00000001.sdmpString found in binary or memory: ttps://consent.google.com/?hl=en-GB&origin=https://www.google.com&continue=https://www.google.com/?gws_rd%3Dssl&if=1&m=0&pc=s&wp=-1&gl=GB&uxe=4421591https://consent.google.com/about:blankhttps://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=4510094152711;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=4510094152711;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fres://C:\Windows\system32\mmcndmgr.dll/views.htmhttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=3&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://www.microsoft.com/en-us/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edge/https://www.microsoft.com/en-us/welcomeie11/https://www.microsoft.com/en-us/edge?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edgehttps://www.microsoft.com/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/edge/https://adservice.google.com/ddm/fls/i/src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fhttps://consent.google.com/done8?continue=https://www.google.com/?gws_rd%3Dssl&origin=https://www.google.com&gl=GB&pc=s&uxe=4421591 equals www.facebook.com (Facebook)
                Source: vbc.exe, 0000000D.00000003.779333133.0000000000AAE000.00000004.00000001.sdmpString found in binary or memory: ttps://consent.google.com/?hl=en-GB&origin=https://www.google.com&continue=https://www.google.com/?gws_rd%3Dssl&if=1&m=0&pc=s&wp=-1&gl=GB&uxe=4421591https://consent.google.com/about:blankhttps://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=4510094152711;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=4510094152711;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fres://C:\Windows\system32\mmcndmgr.dll/views.htmhttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=3&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://www.microsoft.com/en-us/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edge/https://www.microsoft.com/en-us/welcomeie11/https://www.microsoft.com/en-us/edge?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edgehttps://www.microsoft.com/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/edge/https://adservice.google.com/ddm/fls/i/src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fhttps://consent.google.com/done8?continue=https://www.google.com/?gws_rd%3Dssl&origin=https://www.google.com&gl=GB&pc=s&uxe=4421591 equals www.yahoo.com (Yahoo)
                Source: vbc.exe, 0000000D.00000002.779662410.0000000000400000.00000040.00000001.sdmpString found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
                Source: vbc.exe, 0000000D.00000002.779662410.0000000000400000.00000040.00000001.sdmpString found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
                Source: vbc.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
                Source: vbc.exe, 0000000D.00000003.779333133.0000000000AAE000.00000004.00000001.sdmpString found in binary or memory: ttps://consent.google.com/?hl=en-GB&origin=https://www.google.com&continue=https://www.google.com/?gws_rd%3Dssl&if=1&m=0&pc=s&wp=-1&gl=GB&uxe=4421591https://consent.google.com/about:blankhttps://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=4510094152711;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=4510094152711;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fres://C:\Windows\system32\mmcndmgr.dll/views.htmhttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=3&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://www.microsoft.com/en-us/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edge/https://www.microsoft.com/en-us/welcomeie11/https://www.microsoft.com/en-us/edge?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edgehttps://www.microsoft.com/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/edge/https://adservice.google.com/ddm/fls/i/src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fhttps://consent.google.com/done8?continue=https://www.google.com/?gws_rd%3Dssl&origin=https://www.google.com&gl=GB&pc=s&uxe=4421591 equals www.facebook.com (Facebook)
                Source: vbc.exe, 0000000D.00000003.779333133.0000000000AAE000.00000004.00000001.sdmpString found in binary or memory: ttps://consent.google.com/?hl=en-GB&origin=https://www.google.com&continue=https://www.google.com/?gws_rd%3Dssl&if=1&m=0&pc=s&wp=-1&gl=GB&uxe=4421591https://consent.google.com/about:blankhttps://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=4510094152711;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=4510094152711;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fres://C:\Windows\system32\mmcndmgr.dll/views.htmhttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=3&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://www.microsoft.com/en-us/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edge/https://www.microsoft.com/en-us/welcomeie11/https://www.microsoft.com/en-us/edge?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/en-us/edgehttps://www.microsoft.com/edge/?form=MA13DL&OCID=MA13DLhttps://www.microsoft.com/edge/https://adservice.google.com/ddm/fls/i/src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fintl%2Fen_uk%2Fchrome%2Fhttps://consent.google.com/done8?continue=https://www.google.com/?gws_rd%3Dssl&origin=https://www.google.com&gl=GB&pc=s&uxe=4421591 equals www.yahoo.com (Yahoo)
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.agfamonotype.c
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmp, tn9jVPvlMSqAUX5.exe, 00000000.00000003.659291239.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comC
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658931796.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comTC
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.659131617.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comTC;
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.659016913.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comhly
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comic
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comlay
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comter;
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comypo
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.659460402.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comypoooM
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com.TTF
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.662728113.0000000005BEB000.00000004.00000001.sdmp, tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664049989.0000000005BE9000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersC
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.662154281.0000000005BEB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designerse
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.661745512.0000000005BEB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersj
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.662779891.0000000005BE9000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersp
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664193689.0000000005BE9000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designerss
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.662154281.0000000005BEB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designerst
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comalsd
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comd
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.681755462.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comm
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comtud
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.681755462.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comzana
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656517087.0000000005BCB000.00000004.00000001.sdmp, tn9jVPvlMSqAUX5.exe, 00000000.00000003.656388352.0000000005BCB000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656388352.0000000005BCB000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comnte
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656388352.0000000005BCB000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comx
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658175442.0000000005BED000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658458272.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658458272.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn3
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658458272.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnG
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658175442.0000000005BED000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnl-p
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.665387814.0000000005BBD000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                Source: vbc.exe, vbc.exe, 0000000D.00000002.779662410.0000000000400000.00000040.00000001.sdmp, vbc.exe, 0000000D.00000002.779579503.0000000000195000.00000004.00000010.sdmp, 43ogpuf5.fhl.12.dr, wsrpbxdq.ypo.13.drString found in binary or memory: http://www.nirsoft.net/
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656319398.0000000005BCB000.00000004.00000001.sdmp, tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656319398.0000000005BCB000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comuct
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.657584628.0000000005BB6000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr/c
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.657584628.0000000005BB6000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr=
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.657584628.0000000005BB6000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krndo:
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656781448.0000000005BCB000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comR
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656687566.0000000005BCB000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.coma
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656781448.0000000005BCB000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comc
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.de
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                Source: vbc.exeString found in binary or memory: https://login.yahoo.com/config/login
                Source: vbc.exe, 0000000D.00000003.779333133.0000000000AAE000.00000004.00000001.sdmpString found in binary or memory: https://www.google.com&continue=https://www.google.com/?gws_rd%3Dssl&if=1&m=0&pc=s&wp=-1&gl=GB&uxe=4
                Source: vbc.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.agfamonotype.c
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmp, tn9jVPvlMSqAUX5.exe, 00000000.00000003.659291239.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comC
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658931796.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comTC
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.659131617.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comTC;
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.659016913.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comhly
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comic
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comlay
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comter;
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comypo
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.659460402.0000000005BEE000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comypoooM
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com.TTF
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.662728113.0000000005BEB000.00000004.00000001.sdmp, tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664049989.0000000005BE9000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersC
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.662154281.0000000005BEB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designerse
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.661745512.0000000005BEB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersj
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.662779891.0000000005BE9000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersp
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664193689.0000000005BE9000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designerss
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.662154281.0000000005BEB000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designerst
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comalsd
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comd
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.681755462.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comm
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comtud
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.681755462.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comzana
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656517087.0000000005BCB000.00000004.00000001.sdmp, tn9jVPvlMSqAUX5.exe, 00000000.00000003.656388352.0000000005BCB000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656388352.0000000005BCB000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comnte
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656388352.0000000005BCB000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comx
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658175442.0000000005BED000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658458272.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658458272.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn3
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658458272.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnG
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.658175442.0000000005BED000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnl-p
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.665387814.0000000005BBD000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                Source: vbc.exe, vbc.exe, 0000000D.00000002.779662410.0000000000400000.00000040.00000001.sdmp, vbc.exe, 0000000D.00000002.779579503.0000000000195000.00000004.00000010.sdmp, 43ogpuf5.fhl.12.dr, wsrpbxdq.ypo.13.drString found in binary or memory: http://www.nirsoft.net/
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656319398.0000000005BCB000.00000004.00000001.sdmp, tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656319398.0000000005BCB000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comuct
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.657584628.0000000005BB6000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr/c
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.657584628.0000000005BB6000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr=
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.657584628.0000000005BB6000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krndo:
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656781448.0000000005BCB000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comR
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656687566.0000000005BCB000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.coma
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.656781448.0000000005BCB000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comc
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.de
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                Source: vbc.exeString found in binary or memory: https://login.yahoo.com/config/login
                Source: vbc.exe, 0000000D.00000003.779333133.0000000000AAE000.00000004.00000001.sdmpString found in binary or memory: https://www.google.com&continue=https://www.google.com/?gws_rd%3Dssl&if=1&m=0&pc=s&wp=-1&gl=GB&uxe=4
                Source: vbc.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_0040AC8A GetTempPathA,GetWindowsDirectoryA,GetTempFileNameA,OpenClipboard,GetLastError,DeleteFileA,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_0040AC8A GetTempPathA,GetWindowsDirectoryA,GetTempFileNameA,OpenClipboard,GetLastError,DeleteFileA,

                E-Banking Fraud:

                barindex
                Yara detected Nanocore RATShow sources
                Source: Yara matchFile source: 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.679941870.000000000488D000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: tn9jVPvlMSqAUX5.exe PID: 6228, type: MEMORY

                System Summary:

                barindex
                Malicious sample detected (through community Yara rule)Show sources
                Source: 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
                Source: 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
                Source: 00000000.00000002.679941870.000000000488D000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
                Source: 00000000.00000002.679941870.000000000488D000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
                Source: Process Memory Space: tn9jVPvlMSqAUX5.exe PID: 6228, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
                Source: Process Memory Space: tn9jVPvlMSqAUX5.exe PID: 6228, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
                Source: 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
                Source: 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
                Source: 00000000.00000002.679941870.000000000488D000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
                Source: 00000000.00000002.679941870.000000000488D000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
                Source: Process Memory Space: tn9jVPvlMSqAUX5.exe PID: 6228, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
                Source: Process Memory Space: tn9jVPvlMSqAUX5.exe PID: 6228, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_07D016A6 NtQuerySystemInformation,
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_07D016A6 NtQuerySystemInformation,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03494F68
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03491D30
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03492BC8
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034913C0
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03490BD8
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03498AB0
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03494B48
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03494F5A
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_0349A350
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03494D70
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03492B76
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03499508
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03491D21
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03494B38
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034983C8
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034983D8
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03494D80
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03493980
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03493990
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03494390
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034949A9
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034943A0
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034949B8
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034913B0
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03490BB2
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03490099
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03498E91
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034900A8
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03498AA1
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03498EA0
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03499CA0
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_07D73A8E
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_07D75204
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_07D73AED
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_07D73F4D
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03494F68
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03491D30
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03492BC8
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034913C0
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03490BD8
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03498AB0
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03494B48
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03494F5A
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_0349A350
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03494D70
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03492B76
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03499508
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03491D21
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03494B38
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034983C8
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034983D8
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03494D80
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03493980
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03493990
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03494390
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034949A9
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034943A0
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034949B8
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034913B0
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03490BB2
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03490099
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03498E91
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034900A8
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03498AA1
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03498EA0
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03499CA0
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_07D73A8E
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_07D75204
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_07D73AED
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_07D73F4D
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_00404DDB
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_0040BD8A
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_00404E4C
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_00404EBD
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_00404F4E
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00404419
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00404516
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00413538
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_004145A1
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_0040E639
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_004337AF
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_004399B1
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_0043DAE7
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00405CF6
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00403F85
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00411F99
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00411538 appears 35 times
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00413F8E appears 66 times
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00413E2D appears 34 times
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00442A90 appears 36 times
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 004141D6 appears 88 times
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00411538 appears 35 times
                Source: tn9jVPvlMSqAUX5.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                Source: PEcoOLaILWJ.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                Source: tn9jVPvlMSqAUX5.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                Source: PEcoOLaILWJ.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                Source: tn9jVPvlMSqAUX5.exeBinary or memory string: OriginalFilename vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.682572893.0000000006670000.00000002.00000001.sdmpBinary or memory string: originalfilename vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.682572893.0000000006670000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.675653764.0000000000F72000.00000002.00020000.sdmpBinary or memory string: OriginalFilename. vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.685197261.0000000007CA0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameB2B.exe4 vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.681641092.0000000005B70000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMARCUS.dll4 vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.684337664.0000000007B20000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.682504136.0000000006610000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000004.00000000.674548463.0000000000DE2000.00000002.00020000.sdmpBinary or memory string: OriginalFilename. vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000004.00000003.808207077.0000000004A24000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamemailpv.exe< vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exeBinary or memory string: OriginalFilename. vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exeBinary or memory string: OriginalFilename vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.682572893.0000000006670000.00000002.00000001.sdmpBinary or memory string: originalfilename vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.682572893.0000000006670000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.675653764.0000000000F72000.00000002.00020000.sdmpBinary or memory string: OriginalFilename. vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.685197261.0000000007CA0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameB2B.exe4 vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.681641092.0000000005B70000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMARCUS.dll4 vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.684337664.0000000007B20000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.682504136.0000000006610000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000004.00000000.674548463.0000000000DE2000.00000002.00020000.sdmpBinary or memory string: OriginalFilename. vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exe, 00000004.00000003.808207077.0000000004A24000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamemailpv.exe< vs tn9jVPvlMSqAUX5.exe
                Source: tn9jVPvlMSqAUX5.exeBinary or memory string: OriginalFilename. vs tn9jVPvlMSqAUX5.exe
                Source: 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
                Source: 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
                Source: 00000000.00000002.679941870.000000000488D000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
                Source: 00000000.00000002.679941870.000000000488D000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
                Source: Process Memory Space: tn9jVPvlMSqAUX5.exe PID: 6228, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
                Source: Process Memory Space: tn9jVPvlMSqAUX5.exe PID: 6228, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
                Source: 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
                Source: 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
                Source: 00000000.00000002.679941870.000000000488D000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
                Source: 00000000.00000002.679941870.000000000488D000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
                Source: Process Memory Space: tn9jVPvlMSqAUX5.exe PID: 6228, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
                Source: Process Memory Space: tn9jVPvlMSqAUX5.exe PID: 6228, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
                Source: classification engineClassification label: mal100.phis.troj.spyw.evad.winEXE@8/9@0/2
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00415AFD GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00415AFD GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_07D0152A AdjustTokenPrivileges,
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_07D0152A AdjustTokenPrivileges,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00415F87 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00415F87 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00411196 CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,QueryFullProcessImageNameW,CloseHandle,free,Process32NextW,CloseHandle,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00411196 CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,QueryFullProcessImageNameW,CloseHandle,free,Process32NextW,CloseHandle,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_0040ED0B FindResourceA,SizeofResource,LoadResource,LockResource,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_0040ED0B FindResourceA,SizeofResource,LoadResource,LockResource,
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile created: C:\Users\user\AppData\Roaming\PEcoOLaILWJ.exeJump to behavior
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile created: C:\Users\user\AppData\Roaming\PEcoOLaILWJ.exeJump to behavior
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5108:120:WilError_01
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeMutant created: \Sessions\1\BaseNamedObjects\dYrwJsHlWVJ
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{ffb0dc66-d99d-438c-a7fd-cb3d38408dcc}
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5108:120:WilError_01
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeMutant created: \Sessions\1\BaseNamedObjects\dYrwJsHlWVJ
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{ffb0dc66-d99d-438c-a7fd-cb3d38408dcc}
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile created: C:\Users\user\AppData\Local\Temp\tmpECFC.tmpJump to behavior
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile created: C:\Users\user\AppData\Local\Temp\tmpECFC.tmpJump to behavior
                Source: tn9jVPvlMSqAUX5.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                Source: tn9jVPvlMSqAUX5.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSystem information queried: HandleInformation
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSystem information queried: HandleInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                Source: vbc.exeBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                Source: vbc.exeBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                Source: vbc.exe, 0000000D.00000002.779662410.0000000000400000.00000040.00000001.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                Source: vbc.exeBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
                Source: vbc.exeBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                Source: vbc.exeBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                Source: vbc.exeBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                Source: vbc.exeBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                Source: vbc.exeBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                Source: vbc.exe, 0000000D.00000002.779662410.0000000000400000.00000040.00000001.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                Source: vbc.exeBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
                Source: vbc.exeBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                Source: vbc.exeBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                Source: vbc.exeBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                Source: tn9jVPvlMSqAUX5.exeString found in binary or memory: icons8-Add-16
                Source: tn9jVPvlMSqAUX5.exeString found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
                Source: tn9jVPvlMSqAUX5.exeString found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
                Source: tn9jVPvlMSqAUX5.exeString found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail
                Source: tn9jVPvlMSqAUX5.exeString found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail
                Source: tn9jVPvlMSqAUX5.exeString found in binary or memory: icons8-Add-16k!
                Source: tn9jVPvlMSqAUX5.exeString found in binary or memory: icons8-Add-16
                Source: tn9jVPvlMSqAUX5.exeString found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
                Source: tn9jVPvlMSqAUX5.exeString found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
                Source: tn9jVPvlMSqAUX5.exeString found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail
                Source: tn9jVPvlMSqAUX5.exeString found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail
                Source: tn9jVPvlMSqAUX5.exeString found in binary or memory: icons8-Add-16k!
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile read: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeJump to behavior
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile read: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeJump to behavior
                Source: unknownProcess created: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe 'C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe'
                Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\PEcoOLaILWJ' /XML 'C:\Users\user\AppData\Local\Temp\tmpECFC.tmp'
                Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: unknownProcess created: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe {path}
                Source: unknownProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe 'c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe' /shtml 'C:\Users\user\AppData\Local\Temp\43ogpuf5.fhl'
                Source: unknownProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe 'c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe' /shtml 'C:\Users\user\AppData\Local\Temp\wsrpbxdq.ypo'
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\PEcoOLaILWJ' /XML 'C:\Users\user\AppData\Local\Temp\tmpECFC.tmp'
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess created: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe {path}
                Source: unknownProcess created: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe 'C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe'
                Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\PEcoOLaILWJ' /XML 'C:\Users\user\AppData\Local\Temp\tmpECFC.tmp'
                Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: unknownProcess created: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe {path}
                Source: unknownProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe 'c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe' /shtml 'C:\Users\user\AppData\Local\Temp\43ogpuf5.fhl'
                Source: unknownProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe 'c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe' /shtml 'C:\Users\user\AppData\Local\Temp\wsrpbxdq.ypo'
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\PEcoOLaILWJ' /XML 'C:\Users\user\AppData\Local\Temp\tmpECFC.tmp'
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess created: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe {path}
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
                Source: tn9jVPvlMSqAUX5.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                Source: tn9jVPvlMSqAUX5.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                Source: tn9jVPvlMSqAUX5.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                Source: tn9jVPvlMSqAUX5.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                Source: tn9jVPvlMSqAUX5.exeStatic file information: File size 1105920 > 1048576
                Source: tn9jVPvlMSqAUX5.exeStatic file information: File size 1105920 > 1048576
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll
                Source: tn9jVPvlMSqAUX5.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x109a00
                Source: tn9jVPvlMSqAUX5.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x109a00
                Source: tn9jVPvlMSqAUX5.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                Source: tn9jVPvlMSqAUX5.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                Source: Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: tn9jVPvlMSqAUX5.exe, 00000004.00000003.808207077.0000000004A24000.00000004.00000001.sdmp, vbc.exe
                Source: Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: vbc.exe
                Source: Binary string: mscorrc.pdb source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.684337664.0000000007B20000.00000002.00000001.sdmp
                Source: Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: tn9jVPvlMSqAUX5.exe, 00000004.00000003.808207077.0000000004A24000.00000004.00000001.sdmp, vbc.exe
                Source: Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: vbc.exe
                Source: Binary string: mscorrc.pdb source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.684337664.0000000007B20000.00000002.00000001.sdmp
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_00403C3D LoadLibraryA,GetProcAddress,strcpy,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_00403C3D LoadLibraryA,GetProcAddress,strcpy,
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F73DA0 push edx; iretd
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F73185 pushad ; ret
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F72760 push ebx; retf
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F75B4D push edx; retf
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F73134 push eax; retf
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F72333 push ecx; retf
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F72A3F push esp; retf
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F7311E pushad ; ret
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03491922 push ecx; iretd
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03497290 push esi; iretd
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034922BE push edx; retf
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F73DA0 push edx; iretd
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F73185 pushad ; ret
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F72760 push ebx; retf
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F75B4D push edx; retf
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F73134 push eax; retf
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F72333 push ecx; retf
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F72A3F push esp; retf
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_00F7311E pushad ; ret
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03491922 push ecx; iretd
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_03497290 push esi; iretd
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeCode function: 0_2_034922BE push edx; retf
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_00411879 push ecx; ret
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_004118A0 push eax; ret
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_004118A0 push eax; ret
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00442871 push ecx; ret
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00442A90 push eax; ret
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00442A90 push eax; ret
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00446E54 push eax; ret
                Source: initial sampleStatic PE information: section name: .text entropy: 7.37322926627
                Source: initial sampleStatic PE information: section name: .text entropy: 7.37322926627
                Source: initial sampleStatic PE information: section name: .text entropy: 7.37322926627
                Source: initial sampleStatic PE information: section name: .text entropy: 7.37322926627
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile created: C:\Users\user\AppData\Roaming\PEcoOLaILWJ.exeJump to dropped file
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile created: C:\Users\user\AppData\Roaming\PEcoOLaILWJ.exeJump to dropped file

                Boot Survival:

                barindex
                Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
                Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\PEcoOLaILWJ' /XML 'C:\Users\user\AppData\Local\Temp\tmpECFC.tmp'
                Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\PEcoOLaILWJ' /XML 'C:\Users\user\AppData\Local\Temp\tmpECFC.tmp'

                Hooking and other Techniques for Hiding and Protection:

                barindex
                Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile opened: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe:Zone.Identifier read attributes | delete
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile opened: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe:Zone.Identifier read attributes | delete
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_0040F64B memset,strcpy,memset,strcpy,strcat,strcpy,strcat,GetModuleHandleA,LoadLibraryExA,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_0040F64B memset,strcpy,memset,strcpy,strcat,strcpy,strcat,GetModuleHandleA,LoadLibraryExA,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOX

                Malware Analysis System Evasion:

                barindex
                Yara detected AntiVM_3Show sources
                Source: Yara matchFile source: 00000000.00000002.679213235.00000000038CE000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: tn9jVPvlMSqAUX5.exe PID: 6228, type: MEMORY
                Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLLX1
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAMEX1
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLLX1
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAMEX1
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeThread delayed: delay time: 922337203685477
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeThread delayed: delay time: 922337203685477
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeThread delayed: delay time: 922337203685477
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeThread delayed: delay time: 922337203685477
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeWindow / User API: threadDelayed 565
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeWindow / User API: threadDelayed 521
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeWindow / User API: foregroundWindowGot 764
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeWindow / User API: foregroundWindowGot 627
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeWindow / User API: threadDelayed 565
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeWindow / User API: threadDelayed 521
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeWindow / User API: foregroundWindowGot 764
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeWindow / User API: foregroundWindowGot 627
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe TID: 6432Thread sleep time: -41500s >= -30000s
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe TID: 5760Thread sleep time: -922337203685477s >= -30000s
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe TID: 5864Thread sleep time: -1844674407370954s >= -30000s
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe TID: 5732Thread sleep time: -660000s >= -30000s
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe TID: 6432Thread sleep time: -41500s >= -30000s
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe TID: 5760Thread sleep time: -922337203685477s >= -30000s
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe TID: 5864Thread sleep time: -1844674407370954s >= -30000s
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe TID: 5732Thread sleep time: -660000s >= -30000s
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_004161B0 memset,GetSystemInfo,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_004161B0 memset,GetSystemInfo,
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMware
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: vmwareX1
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMWARE|9
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: q#"SOFTWARE\VMware, Inc.\VMware ToolsX1
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: q&%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\X1
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMware|9
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMware |9
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIX1
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMWARE
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMWAREX1
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMware
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: QEMUX1
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMware
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: vmwareX1
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMWARE|9
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: q#"SOFTWARE\VMware, Inc.\VMware ToolsX1
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: q&%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\X1
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMware|9
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMware |9
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIX1
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMWARE
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMWAREX1
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMware
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: QEMUX1
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.679846825.0000000003BB8000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information queried: ProcessInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess information queried: ProcessInformation
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_00403C3D LoadLibraryA,GetProcAddress,strcpy,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_00403C3D LoadLibraryA,GetProcAddress,strcpy,
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess token adjusted: Debug
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess token adjusted: Debug
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess token adjusted: Debug
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess token adjusted: Debug
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeMemory allocated: page read and write | page guard
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeMemory allocated: page read and write | page guard

                HIPS / PFW / Operating System Protection Evasion:

                barindex
                Injects a PE file into a foreign processesShow sources
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeMemory written: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe base: 400000 value starts with: 4D5A
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeMemory written: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe base: 400000 value starts with: 4D5A
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\PEcoOLaILWJ' /XML 'C:\Users\user\AppData\Local\Temp\tmpECFC.tmp'
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess created: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe {path}
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\PEcoOLaILWJ' /XML 'C:\Users\user\AppData\Local\Temp\tmpECFC.tmp'
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeProcess created: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe {path}
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_0041604B GetSystemTime,memcpy,GetCurrentProcessId,memcpy,GetTickCount,memcpy,QueryPerformanceCounter,memcpy,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 13_2_0041604B GetSystemTime,memcpy,GetCurrentProcessId,memcpy,GetTickCount,memcpy,QueryPerformanceCounter,memcpy,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_0040724C memset,memset,memset,memset,GetComputerNameA,GetUserNameA,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,strlen,strlen,memcpy,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_0040724C memset,memset,memset,memset,GetComputerNameA,GetUserNameA,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,strlen,strlen,memcpy,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_00406278 GetVersionExA,
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 12_2_00406278 GetVersionExA,
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
                Source: C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

                Stealing of Sensitive Information:

                barindex
                Yara detected MailPassViewShow sources
                Source: Yara matchFile source: 0000000C.00000002.774211357.0000000000400000.00000040.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000003.808207077.0000000004A24000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: vbc.exe PID: 5852, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: tn9jVPvlMSqAUX5.exe PID: 940, type: MEMORY
                Source: Yara matchFile source: 12.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 12.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
                Yara detected Nanocore RATShow sources
                Source: Yara matchFile source: 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.679941870.000000000488D000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: tn9jVPvlMSqAUX5.exe PID: 6228, type: MEMORY
                Tries to harvest and steal browser information (history, passwords, etc)Show sources
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
                Tries to steal Instant Messenger accounts or passwordsShow sources
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Dynamic Salt
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Dynamic Salt
                Tries to steal Mail credentials (via file access)Show sources
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
                Tries to steal Mail credentials (via file registry)Show sources
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, PopPassword
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, SMTPPassword
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: ESMTPPassword
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, PopPassword
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, SMTPPassword
                Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: ESMTPPassword
                Yara detected WebBrowserPassView password recovery toolShow sources
                Source: Yara matchFile source: 0000000D.00000002.779662410.0000000000400000.00000040.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: vbc.exe PID: 2228, type: MEMORY
                Source: Yara matchFile source: 13.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 13.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE

                Remote Access Functionality:

                barindex
                Detected Nanocore RatShow sources
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmpString found in binary or memory: NanoCore.ClientPluginHost
                Source: tn9jVPvlMSqAUX5.exe, 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmpString found in binary or memory: NanoCore.ClientPluginHost
                Yara detected Nanocore RATShow sources
                Source: Yara matchFile source: 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.679941870.000000000488D000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: tn9jVPvlMSqAUX5.exe PID: 6228, type: MEMORY

                Mitre Att&ck Matrix

                Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                Valid AccountsWindows Management Instrumentation1Application Shimming1Application Shimming1Disable or Modify Tools1OS Credential Dumping1System Time Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                Default AccountsNative API1Scheduled Task/Job1Access Token Manipulation1Deobfuscate/Decode Files or Information1Credentials in Registry2Account Discovery1Remote Desktop ProtocolData from Local System1Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                Domain AccountsCommand and Scripting Interpreter2Logon Script (Windows)Process Injection111Obfuscated Files or Information4Credentials In Files1File and Directory Discovery2SMB/Windows Admin SharesEmail Collection1Automated ExfiltrationRemote Access Software1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                Local AccountsScheduled Task/Job1Logon Script (Mac)Scheduled Task/Job1Software Packing1NTDSSystem Information Discovery18Distributed Component Object ModelClipboard Data1Scheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptMasquerading1LSA SecretsSecurity Software Discovery131SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                Replication Through Removable MediaLaunchdRc.commonRc.commonVirtualization/Sandbox Evasion3Cached Domain CredentialsVirtualization/Sandbox Evasion3VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                External Remote ServicesScheduled TaskStartup ItemsStartup ItemsAccess Token Manipulation1DCSyncProcess Discovery3Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobProcess Injection111Proc FilesystemApplication Window Discovery1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Hidden Files and Directories1/etc/passwd and /etc/shadowSystem Owner/User Discovery1Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 signatures2 2 Behavior Graph ID: 319578 Sample: tn9jVPvlMSqAUX5.exe Startdate: 18/11/2020 Architecture: WINDOWS Score: 100 38 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 Sigma detected: Scheduled temp file as task from temp location 2->42 44 10 other signatures 2->44 7 tn9jVPvlMSqAUX5.exe 6 2->7         started        process3 file4 26 C:\Users\user\AppData\...\PEcoOLaILWJ.exe, PE32 7->26 dropped 28 C:\Users\user\AppData\Local\...\tmpECFC.tmp, XML 7->28 dropped 30 C:\Users\user\...\tn9jVPvlMSqAUX5.exe.log, ASCII 7->30 dropped 54 Injects a PE file into a foreign processes 7->54 11 tn9jVPvlMSqAUX5.exe 11 7->11         started        16 schtasks.exe 1 7->16         started        signatures5 process6 dnsIp7 36 23.105.131.229, 4040, 49743 LEASEWEB-USA-NYC-11US United States 11->36 32 C:\Users\user\AppData\Roaming\...\run.dat, Non-ISO 11->32 dropped 56 Hides that the sample has been downloaded from the Internet (zone.identifier) 11->56 18 vbc.exe 1 11->18         started        21 vbc.exe 13 11->21         started        24 conhost.exe 16->24         started        file8 signatures9 process10 dnsIp11 46 Tries to steal Mail credentials (via file registry) 18->46 48 Tries to steal Instant Messenger accounts or passwords 18->48 50 Tries to steal Mail credentials (via file access) 18->50 34 192.168.2.1 unknown unknown 21->34 52 Tries to harvest and steal browser information (history, passwords, etc) 21->52 signatures12

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                tn9jVPvlMSqAUX5.exe100%Joe Sandbox ML

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\Users\user\AppData\Roaming\PEcoOLaILWJ.exe100%Joe Sandbox ML

                Unpacked PE Files

                No Antivirus matches

                Domains

                No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                http://www.tiro.com0%URL Reputationsafe
                http://www.tiro.com0%URL Reputationsafe
                http://www.tiro.com0%URL Reputationsafe
                http://www.tiro.com0%URL Reputationsafe
                http://www.goodfont.co.kr0%URL Reputationsafe
                http://www.goodfont.co.kr0%URL Reputationsafe
                http://www.goodfont.co.kr0%URL Reputationsafe
                http://www.goodfont.co.kr0%URL Reputationsafe
                http://www.carterandcone.com0%URL Reputationsafe
                http://www.carterandcone.com0%URL Reputationsafe
                http://www.carterandcone.com0%URL Reputationsafe
                http://www.carterandcone.com0%URL Reputationsafe
                http://www.founder.com.cn/cnG0%Avira URL Cloudsafe
                http://www.carterandcone.comypo0%Avira URL Cloudsafe
                http://www.sajatypeworks.com0%URL Reputationsafe
                http://www.sajatypeworks.com0%URL Reputationsafe
                http://www.sajatypeworks.com0%URL Reputationsafe
                http://www.typography.netD0%URL Reputationsafe
                http://www.typography.netD0%URL Reputationsafe
                http://www.typography.netD0%URL Reputationsafe
                http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                http://fontfabrik.com0%URL Reputationsafe
                http://fontfabrik.com0%URL Reputationsafe
                http://fontfabrik.com0%URL Reputationsafe
                http://www.fontbureau.comtud0%Avira URL Cloudsafe
                http://www.carterandcone.comC0%URL Reputationsafe
                http://www.carterandcone.comC0%URL Reputationsafe
                http://www.carterandcone.comC0%URL Reputationsafe
                http://www.carterandcone.comTC;0%Avira URL Cloudsafe
                http://www.carterandcone.comypoooM0%Avira URL Cloudsafe
                http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                http://www.carterandcone.comter;0%Avira URL Cloudsafe
                http://www.sandoll.co.kr0%URL Reputationsafe
                http://www.sandoll.co.kr0%URL Reputationsafe
                http://www.sandoll.co.kr0%URL Reputationsafe
                http://www.carterandcone.comlay0%Avira URL Cloudsafe
                http://www.urwpp.deDPlease0%URL Reputationsafe
                http://www.urwpp.deDPlease0%URL Reputationsafe
                http://www.urwpp.deDPlease0%URL Reputationsafe
                http://www.urwpp.de0%URL Reputationsafe
                http://www.urwpp.de0%URL Reputationsafe
                http://www.urwpp.de0%URL Reputationsafe
                http://www.zhongyicts.com.cn0%URL Reputationsafe
                http://www.zhongyicts.com.cn0%URL Reputationsafe
                http://www.zhongyicts.com.cn0%URL Reputationsafe
                http://www.sakkal.com0%URL Reputationsafe
                http://www.sakkal.com0%URL Reputationsafe
                http://www.sakkal.com0%URL Reputationsafe
                http://www.fontbureau.com.TTF0%URL Reputationsafe
                http://www.fontbureau.com.TTF0%URL Reputationsafe
                http://www.fontbureau.com.TTF0%URL Reputationsafe
                http://www.fonts.comx0%Avira URL Cloudsafe
                http://www.founder.com.cn/cnl-p0%Avira URL Cloudsafe
                http://www.carterandcone.comic0%Avira URL Cloudsafe
                http://www.fontbureau.comalsd0%Avira URL Cloudsafe
                http://www.sandoll.co.kr=0%Avira URL Cloudsafe
                http://www.agfamonotype.c0%Avira URL Cloudsafe
                http://www.galapagosdesign.com/0%URL Reputationsafe
                http://www.galapagosdesign.com/0%URL Reputationsafe
                http://www.galapagosdesign.com/0%URL Reputationsafe
                http://www.carterandcone.comTC0%URL Reputationsafe
                http://www.carterandcone.comTC0%URL Reputationsafe
                http://www.carterandcone.comTC0%URL Reputationsafe
                http://www.fonts.comnte0%Avira URL Cloudsafe
                http://www.fontbureau.comzana0%Avira URL Cloudsafe
                http://www.fontbureau.comd0%URL Reputationsafe
                http://www.fontbureau.comd0%URL Reputationsafe
                http://www.fontbureau.comd0%URL Reputationsafe
                http://www.sajatypeworks.comuct0%Avira URL Cloudsafe
                http://www.carterandcone.coml0%URL Reputationsafe
                http://www.carterandcone.coml0%URL Reputationsafe
                http://www.carterandcone.coml0%URL Reputationsafe
                http://www.sandoll.co.kr/c0%Avira URL Cloudsafe
                http://www.founder.com.cn/cn/0%URL Reputationsafe
                http://www.founder.com.cn/cn/0%URL Reputationsafe
                http://www.founder.com.cn/cn/0%URL Reputationsafe
                http://www.founder.com.cn/cn0%URL Reputationsafe
                http://www.founder.com.cn/cn0%URL Reputationsafe
                http://www.founder.com.cn/cn0%URL Reputationsafe
                http://www.carterandcone.comhly0%Avira URL Cloudsafe
                http://www.sandoll.co.krndo:0%Avira URL Cloudsafe
                http://www.tiro.comR0%Avira URL Cloudsafe
                http://www.founder.com.cn/cn30%Avira URL Cloudsafe
                http://www.fontbureau.comm0%URL Reputationsafe
                http://www.fontbureau.comm0%URL Reputationsafe
                http://www.fontbureau.comm0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                http://www.jiyu-kobo.co.jp/0%URL Reputationsafe

                Domains and IPs

                Contacted Domains

                No contacted domains info

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                http://www.fontbureau.com/designersGtn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                  		high
                  http://www.fontbureau.com/designers/?tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                    		high
                    http://www.founder.com.cn/cn/bThetn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    		unknown
                    http://www.fontbureau.com/designers?tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                      		high
                      http://www.fontbureau.com/designersCtn9jVPvlMSqAUX5.exe, 00000000.00000003.664049989.0000000005BE9000.00000004.00000001.sdmpfalse
                        		high
                        http://www.tiro.comtn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designerstn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                          		high
                          http://www.goodfont.co.krtn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.carterandcone.comtn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmp, tn9jVPvlMSqAUX5.exe, 00000000.00000003.659291239.0000000005BEE000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.founder.com.cn/cnGtn9jVPvlMSqAUX5.exe, 00000000.00000003.658458272.0000000005BB4000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.carterandcone.comypotn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.sajatypeworks.comtn9jVPvlMSqAUX5.exe, 00000000.00000003.656319398.0000000005BCB000.00000004.00000001.sdmp, tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.typography.netDtn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.founder.com.cn/cn/cThetn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.galapagosdesign.com/staff/dennis.htmtn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://fontfabrik.comtn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.comtudtn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.carterandcone.comCtn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designersjtn9jVPvlMSqAUX5.exe, 00000000.00000003.661745512.0000000005BEB000.00000004.00000001.sdmpfalse
                            		high
                            http://www.fontbureau.com/designersetn9jVPvlMSqAUX5.exe, 00000000.00000003.662154281.0000000005BEB000.00000004.00000001.sdmpfalse
                              		high
                              http://www.carterandcone.comTC;tn9jVPvlMSqAUX5.exe, 00000000.00000003.659131617.0000000005BEE000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		low
                              http://www.carterandcone.comypoooMtn9jVPvlMSqAUX5.exe, 00000000.00000003.659460402.0000000005BEE000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.galapagosdesign.com/DPleasetn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.carterandcone.comter;tn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		low
                              https://login.yahoo.com/config/loginvbc.exefalse
                                		high
                                http://www.fonts.comtn9jVPvlMSqAUX5.exe, 00000000.00000003.656517087.0000000005BCB000.00000004.00000001.sdmp, tn9jVPvlMSqAUX5.exe, 00000000.00000003.656388352.0000000005BCB000.00000004.00000001.sdmpfalse
                                  		high
                                  http://www.sandoll.co.krtn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.carterandcone.comlaytn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.urwpp.deDPleasetn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.nirsoft.net/vbc.exe, vbc.exe, 0000000D.00000002.779662410.0000000000400000.00000040.00000001.sdmp, vbc.exe, 0000000D.00000002.779579503.0000000000195000.00000004.00000010.sdmp, 43ogpuf5.fhl.12.dr, wsrpbxdq.ypo.13.drfalse
                                    		high
                                    http://www.urwpp.detn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.zhongyicts.com.cntn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.com/designersptn9jVPvlMSqAUX5.exe, 00000000.00000003.662779891.0000000005BE9000.00000004.00000001.sdmpfalse
                                      		high
                                      http://www.sakkal.comtn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.com.TTFtn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fonts.comxtn9jVPvlMSqAUX5.exe, 00000000.00000003.656388352.0000000005BCB000.00000004.00000001.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.founder.com.cn/cnl-ptn9jVPvlMSqAUX5.exe, 00000000.00000003.658175442.0000000005BED000.00000004.00000001.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.fontbureau.com/designersttn9jVPvlMSqAUX5.exe, 00000000.00000003.662154281.0000000005BEB000.00000004.00000001.sdmpfalse
                                        		high
                                        http://www.carterandcone.comictn9jVPvlMSqAUX5.exe, 00000000.00000003.658966784.0000000005BEE000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.fontbureau.com/designersstn9jVPvlMSqAUX5.exe, 00000000.00000003.664193689.0000000005BE9000.00000004.00000001.sdmpfalse
                                          		high
                                          http://www.fontbureau.comalsdtn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.sandoll.co.kr=tn9jVPvlMSqAUX5.exe, 00000000.00000003.657584628.0000000005BB6000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		low
                                          http://www.agfamonotype.ctn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.apache.org/licenses/LICENSE-2.0tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                                            		high
                                            http://www.fontbureau.comtn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpfalse
                                              		high
                                              http://www.galapagosdesign.com/tn9jVPvlMSqAUX5.exe, 00000000.00000003.665387814.0000000005BBD000.00000004.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.carterandcone.comTCtn9jVPvlMSqAUX5.exe, 00000000.00000003.658931796.0000000005BEE000.00000004.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.fonts.comntetn9jVPvlMSqAUX5.exe, 00000000.00000003.656388352.0000000005BCB000.00000004.00000001.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.fontbureau.comzanatn9jVPvlMSqAUX5.exe, 00000000.00000002.681755462.0000000005BB0000.00000004.00000001.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.fontbureau.comdtn9jVPvlMSqAUX5.exe, 00000000.00000003.664377780.0000000005BB4000.00000004.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.sajatypeworks.comucttn9jVPvlMSqAUX5.exe, 00000000.00000003.656319398.0000000005BCB000.00000004.00000001.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.carterandcone.comltn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.sandoll.co.kr/ctn9jVPvlMSqAUX5.exe, 00000000.00000003.657584628.0000000005BB6000.00000004.00000001.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.founder.com.cn/cn/tn9jVPvlMSqAUX5.exe, 00000000.00000003.658458272.0000000005BB4000.00000004.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.fontbureau.com/designers/cabarga.htmlNtn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                                                		high
                                                http://www.founder.com.cn/cntn9jVPvlMSqAUX5.exe, 00000000.00000003.658175442.0000000005BED000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.fontbureau.com/designers/frere-user.htmltn9jVPvlMSqAUX5.exe, 00000000.00000003.662728113.0000000005BEB000.00000004.00000001.sdmp, tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                                                  		high
                                                  http://www.carterandcone.comhlytn9jVPvlMSqAUX5.exe, 00000000.00000003.659016913.0000000005BEE000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.sandoll.co.krndo:tn9jVPvlMSqAUX5.exe, 00000000.00000003.657584628.0000000005BB6000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.tiro.comRtn9jVPvlMSqAUX5.exe, 00000000.00000003.656781448.0000000005BCB000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.founder.com.cn/cn3tn9jVPvlMSqAUX5.exe, 00000000.00000003.658458272.0000000005BB4000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.fontbureau.commtn9jVPvlMSqAUX5.exe, 00000000.00000002.681755462.0000000005BB0000.00000004.00000001.sdmpfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.jiyu-kobo.co.jp/tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.fontbureau.com/designers8tn9jVPvlMSqAUX5.exe, 00000000.00000002.683195015.0000000006B20000.00000002.00000001.sdmpfalse
                                                    		high
                                                    http://www.tiro.comctn9jVPvlMSqAUX5.exe, 00000000.00000003.656781448.0000000005BCB000.00000004.00000001.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.tiro.comatn9jVPvlMSqAUX5.exe, 00000000.00000003.656687566.0000000005BCB000.00000004.00000001.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown

                                                    Contacted IPs

                                                    • No. of IPs < 25%
                                                    • 25% < No. of IPs < 50%
                                                    • 50% < No. of IPs < 75%
                                                    • 75% < No. of IPs

                                                    Public

                                                    IPDomainCountryFlagASNASN NameMalicious
                                                    23.105.131.229
                                                    		unknownUnited States
                                                    		396362LEASEWEB-USA-NYC-11UStrue

                                                    Private

                                                    IP
                                                    192.168.2.1

                                                    General Information

                                                    Joe Sandbox Version:31.0.0 Red Diamond
                                                    Analysis ID:319578
                                                    Start date:18.11.2020
                                                    Start time:13:05:51
                                                    Joe Sandbox Product:CloudBasic
                                                    Overall analysis duration:0h 8m 24s
                                                    Hypervisor based Inspection enabled:false
                                                    Report type:light
                                                    Sample file name:tn9jVPvlMSqAUX5.exe
                                                    Cookbook file name:default.jbs
                                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                    Number of analysed new started processes analysed:20
                                                    Number of new started drivers analysed:0
                                                    Number of existing processes analysed:0
                                                    Number of existing drivers analysed:0
                                                    Number of injected processes analysed:0
                                                    Technologies:
                                                    • HCA enabled
                                                    • EGA enabled
                                                    • HDC enabled
                                                    • AMSI enabled
                                                    Analysis Mode:default
                                                    Analysis stop reason:Timeout
                                                    Detection:MAL
                                                    Classification:mal100.phis.troj.spyw.evad.winEXE@8/9@0/2
                                                    EGA Information:Failed
                                                    HDC Information:
                                                    • Successful, ratio: 37.5% (good quality ratio 33.1%)
                                                    • Quality average: 72.8%
                                                    • Quality standard deviation: 34.8%
                                                    HCA Information:
                                                    • Successful, ratio: 91%
                                                    • Number of executed functions: 0
                                                    • Number of non-executed functions: 0
                                                    Cookbook Comments:
                                                    • Adjust boot time
                                                    • Enable AMSI
                                                    • Found application associated with file extension: .exe
                                                    Warnings:
                                                    Show All
                                                    • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                                    • TCP Packets have been reduced to 100
                                                    • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
                                                    • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                    • Report size getting too big, too many NtQueryValueKey calls found.

                                                    Simulations

                                                    Behavior and APIs

                                                    TimeTypeDescription
                                                    13:06:49API Interceptor961x Sleep call for process: tn9jVPvlMSqAUX5.exe modified

                                                    Joe Sandbox View / Context

                                                    IPs

                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                    23.105.131.229LaCaixa_Aviso.exeGet hashmaliciousBrowse
                                                      L0caDBOEgr.exeGet hashmaliciousBrowse

                                                        Domains

                                                        No context

                                                        ASN

                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                        LEASEWEB-USA-NYC-11USHLiw2LPA8i.rtfGet hashmaliciousBrowse
                                                        • 192.253.246.143
                                                        TDToxqrclL.exeGet hashmaliciousBrowse
                                                        • 23.105.131.177
                                                        Ziiq5tI3CT.exeGet hashmaliciousBrowse
                                                        • 23.105.131.239
                                                        f3wo2FuLN6.exeGet hashmaliciousBrowse
                                                        • 192.253.246.143
                                                        ORDER INQUIRY.pdf.exeGet hashmaliciousBrowse
                                                        • 23.105.131.177
                                                        Purchase Order 4500033557.pdf.exeGet hashmaliciousBrowse
                                                        • 23.105.131.177
                                                        SecuriteInfo.com.Trojan.DownLoader35.34609.25775.exeGet hashmaliciousBrowse
                                                        • 192.253.246.138
                                                        Proof_of_payment.xlsmGet hashmaliciousBrowse
                                                        • 23.105.131.217
                                                        invoice tax.xlsmGet hashmaliciousBrowse
                                                        • 23.105.131.217
                                                        SHIPPING DOCUMENTS.pdf.exeGet hashmaliciousBrowse
                                                        • 23.105.131.177
                                                        Payment_Order_20201111.xlsxGet hashmaliciousBrowse
                                                        • 192.253.246.138
                                                        TLpMnhJmg7.exeGet hashmaliciousBrowse
                                                        • 192.253.246.143
                                                        HDyADDoI3I.exeGet hashmaliciousBrowse
                                                        • 192.253.246.143
                                                        11.exeGet hashmaliciousBrowse
                                                        • 173.234.155.145
                                                        53C29QAJnd.exeGet hashmaliciousBrowse
                                                        • 173.234.155.145
                                                        OMQZvmAmCj.exeGet hashmaliciousBrowse
                                                        • 173.234.155.145
                                                        gH4o5FCHAE.exeGet hashmaliciousBrowse
                                                        • 173.234.155.145
                                                        SHIPPING INVOICE.pdf.exeGet hashmaliciousBrowse
                                                        • 23.105.131.177
                                                        DOCUMENTO WAYBILL.exeGet hashmaliciousBrowse
                                                        • 23.105.131.133
                                                        Proof Of Payment.exeGet hashmaliciousBrowse
                                                        • 23.105.131.129

                                                        JA3 Fingerprints

                                                        No context

                                                        Dropped Files

                                                        No context

                                                        Created / dropped Files

                                                        C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\tn9jVPvlMSqAUX5.exe.log
                                                        Process:C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):641
                                                        Entropy (8bit):5.271473536084351
                                                        Encrypted:false
                                                        SSDEEP:12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk70U2u7x5I6Hi0Ug+9Yz9tv:MLF20NaL329hJ5g522rW2I3rOz2T
                                                        MD5:C3EC08CD6BEA8576070D5A52B4B6D7D0
                                                        SHA1:40B95253F98B3CC5953100C0E71DAC7915094A5A
                                                        SHA-256:28B314C3E5651414FD36B2A65B644A2A55F007A34A536BE17514E12CEE5A091B
                                                        SHA-512:5B0E6398A092F08240DC6765425E16DB52F32542FF7250E87403C407E54B3660EF93E0EAD17BA2CEF6B666951ACF66FA0EAD61FB52E80867DDD398E8258DED22
                                                        Malicious:true
                                                        Reputation:moderate, very likely benign file
                                                        Preview: 1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\d05d469d89b319a068f2123e7e6f8621\System.Web.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..
                                                        C:\Users\user\AppData\Local\Temp\43ogpuf5.fhl
                                                        Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                        File Type:HTML document, ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):523
                                                        Entropy (8bit):5.166440724009737
                                                        Encrypted:false
                                                        SSDEEP:12:BMQkS9xyR4VrR1LEIJ9yuNJmcfNXbYmvmAwYxZwgJwnbnyAwoE:WlS9v5N9ZmcfSYm0XwgynbnyF
                                                        MD5:69B2A2E17E78D24ABEE9F1DE2F04811A
                                                        SHA1:D19C109704E83876AB3527457F9418A7D053AA33
                                                        SHA-256:1B1491F21E64681F8FDC27B2265E2274FB7813EECB6AD8B446D2E431F6300EDD
                                                        SHA-512:EB7269979BC4187520636FE3D7B3089F2C7C02E81C4CE2A738ADE680F72C61C67FE9577EEAA09D3CA93F34B60BE8C434D2CFBFED6566E783F6611279F056150F
                                                        Malicious:false
                                                        Reputation:moderate, very likely benign file
                                                        Preview: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">..<html><head><title>Email Accounts List</title></head>..<body>.. <h3>Email Accounts List</h3>..<br><h4>Created by using <a href="http://www.nirsoft.net/" target="newwin">Mail PassView</a></h4><p><table border="1" cellpadding="5"><tr bgcolor="E0E0E0">..<th>Name..<th>Application..<th>Email..<th>Server..<th>Server Port..<th>Secured..<th>Type..<th>User..<th>Password..<th>Profile..<th>Password Strength..<th>SMTP Server..<th>SMTP Server Port..</table>....</body></html>
                                                        C:\Users\user\AppData\Local\Temp\tmpECFC.tmp
                                                        Process:C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe
                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):1644
                                                        Entropy (8bit):5.180401522136723
                                                        Encrypted:false
                                                        SSDEEP:24:2dH4+SEqC/S7hblNMFp//rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBGltn:cbhK79lNQR/rydbz9I3YODOLNdq3u
                                                        MD5:228F35FD2A67C0B22B41D42B4C2F10F6
                                                        SHA1:33E121CF192B7B3CB6960A5CC054277E071F7E4A
                                                        SHA-256:6EECB36A770C3E13E8C58F56D8B8557667B2108265B61AB3F5F0F321CD2D2A11
                                                        SHA-512:A2F02938F0B699F124A2B294A9FF4AA3F35F6453DE02B363B819FA470014A87E337997DBC8148F0A765A3168A20A1BD8075AFC007E1681E47397444FA3D55B2E
                                                        Malicious:true
                                                        Reputation:low
                                                        Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true
                                                        C:\Users\user\AppData\Local\Temp\wsrpbxdq.ypo
                                                        Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                        File Type:HTML document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):926
                                                        Entropy (8bit):3.5897431793749606
                                                        Encrypted:false
                                                        SSDEEP:24:QAl45i94TBYTCvq4A3Y7eOhv8UFaoQBIn4+pS:a5icwVTOhnFaoQ+n4+4
                                                        MD5:919E671C3D5959A91EF2D4C377D2B2FF
                                                        SHA1:B1202B19512BBD390D3D5164792501C87BB42C41
                                                        SHA-256:D2E079DF7CF6388315368BA79BF099AD2FF5428AF51BF5ABF2D99A2D7C5EB651
                                                        SHA-512:F3298256372BEAB8EFE81B2E08D3B3869281F625DE1EE13189C6B95EB2134D223DF6F64CC9E490DD6B52A53AA936ADC17BD5DFE4E50EE0FE420F3EBAE276381C
                                                        Malicious:false
                                                        Reputation:moderate, very likely benign file
                                                        Preview: ..<.!.D.O.C.T.Y.P.E. .H.T.M.L. .P.U.B.L.I.C. .".-././.W.3.C././.D.T.D. .H.T.M.L. .3...2. .F.i.n.a.l././.E.N.".>.....<.h.t.m.l.>.<.h.e.a.d.>.<.t.i.t.l.e.>.W.e.b. .B.r.o.w.s.e.r. .P.a.s.s.w.o.r.d.s.<./.t.i.t.l.e.>.<./.h.e.a.d.>.....<.b.o.d.y.>..... .<.h.3.>.W.e.b. .B.r.o.w.s.e.r. .P.a.s.s.w.o.r.d.s.<./.h.3.>.....<.b.r.>.<.h.4.>.C.r.e.a.t.e.d. .b.y. .u.s.i.n.g. .<.a. .h.r.e.f.=.".h.t.t.p.:././.w.w.w...n.i.r.s.o.f.t...n.e.t./.". .t.a.r.g.e.t.=.".n.e.w.w.i.n.".>.W.e.b.B.r.o.w.s.e.r.P.a.s.s.V.i.e.w.<./.a.>.<./.h.4.>.<.p.>.<.t.a.b.l.e. .b.o.r.d.e.r.=.".1.". .c.e.l.l.p.a.d.d.i.n.g.=.".5.".>.<.t.r. .b.g.c.o.l.o.r.=.".E.0.E.0.E.0.".>.....<.t.h.>.U.R.L.....<.t.h.>.W.e.b. .B.r.o.w.s.e.r.....<.t.h.>.U.s.e.r. .N.a.m.e.....<.t.h.>.P.a.s.s.w.o.r.d.....<.t.h.>.P.a.s.s.w.o.r.d. .S.t.r.e.n.g.t.h.....<.t.h.>.U.s.e.r. .N.a.m.e. .F.i.e.l.d.....<.t.h.>.P.a.s.s.w.o.r.d. .F.i.e.l.d.....<./.t.a.b.l.e.>.........<./.b.o.d.y.>.<./.h.t.m.l.>.
                                                        C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat
                                                        Process:C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):232
                                                        Entropy (8bit):7.024371743172393
                                                        Encrypted:false
                                                        SSDEEP:6:X4LDAnybgCFcpJSQwP4d7ZrqJgTFwoaw+9XU4:X4LEnybgCFCtvd7ZrCgpwoaw+Z9
                                                        MD5:32D0AAE13696FF7F8AF33B2D22451028
                                                        SHA1:EF80C4E0DB2AE8EF288027C9D3518E6950B583A4
                                                        SHA-256:5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
                                                        SHA-512:1D77FC13512C0DBC4EFD7A66ACB502481E4EFA0FB73D0C7D0942448A72B9B05BA1EA78DDF0BE966363C2E3122E0B631DB7630D044D08C1E1D32B9FB025C356A5
                                                        Malicious:false
                                                        Reputation:moderate, very likely benign file
                                                        Preview: Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.
                                                        C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
                                                        Process:C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe
                                                        File Type:Non-ISO extended-ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):8
                                                        Entropy (8bit):3.0
                                                        Encrypted:false
                                                        SSDEEP:3:TVqt:T0t
                                                        MD5:B1ADE59B3659FA064C8FAA74E453DDEF
                                                        SHA1:9843CA8533A9B0A78354C73B2A5338D98EC824D1
                                                        SHA-256:58E2D4D1C4B6292CCE8BED81F764BC5483A48696E2708719893C0B05FAC2A9B9
                                                        SHA-512:429AC6A1155919E171805F27B9EF314777C825229961A441CFA41313E6349196959256B99F4B7D66F8C20DA6B703DF1825B397FC437A41625B41728EBA4434B2
                                                        Malicious:true
                                                        Preview: }TGp...H
                                                        C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bin
                                                        Process:C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):40
                                                        Entropy (8bit):5.221928094887364
                                                        Encrypted:false
                                                        SSDEEP:3:9bzY6oRDMjmPl:RzWDMCd
                                                        MD5:AE0F5E6CE7122AF264EC533C6B15A27B
                                                        SHA1:1265A495C42EED76CC043D50C60C23297E76CCE1
                                                        SHA-256:73B0B92179C61C26589B47E9732CE418B07EDEE3860EE5A2A5FB06F3B8AA9B26
                                                        SHA-512:DD44C2D24D4E3A0F0B988AD3D04683B5CB128298043134649BBE33B2512CE0C9B1A8E7D893B9F66FBBCDD901E2B0646C4533FB6C0C8C4AFCB95A0EFB95D446F8
                                                        Malicious:false
                                                        Preview: 9iH...}Z.4..f..... 8.j....|.&X..e.F.*.
                                                        C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\storage.dat
                                                        Process:C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):426840
                                                        Entropy (8bit):7.999608491116724
                                                        Encrypted:true
                                                        SSDEEP:12288:zKf137EiDsTjevgA4p0V7njXuWSvdVU7V4OC0Rr:+134i2lp67i5d8+OCg
                                                        MD5:963D5E2C9C0008DFF05518B47C367A7F
                                                        SHA1:C183D601FABBC9AC8FBFA0A0937DECC677535E74
                                                        SHA-256:5EACF2974C9BB2C2E24CDC651C4840DD6F4B76A98F0E85E90279F1DBB2E6F3C0
                                                        SHA-512:0C04E1C1A13070D48728D9F7F300D9B26DEC6EC8875D8D3017EAD52B9EE5BDF9B651A7F0FCC537761212831107646ED72B8ED017E7477E600BC0137EF857AE2C
                                                        Malicious:false
                                                        Preview: ..g&jo...IPg...GM....R>i...o...I.>.&.r{....8...}...E....v.!7.u3e.. .....db...}.......".t(.xC9.cp.B....7...'.......%......w.^.._.......B.W%.<..i.0.{9.xS...5...)..w..$..C..?`F..u.5.T.X.w'Si..z.n{...Y!m...RA...xg....[7...z..9@.K.-...T..+.ACe....R....enO.....AoNMT.\^....}H&..4I...B.:..@..J...v..rI5..kP......2j....B..B.~.T..>.c..emW;Rn<9..[.r.o....R[....@=...:...L.g<.....I..%4[.G^.~.l'......v.p&.........+..S...9d/.{..H.`@.1..........f.\s...X.a.].<.h*...J4*...k.x....%3.......3.c..?%....>.!.}..)(.{...H...3..`'].Q.[sN..JX(.%pH....+......(...v.....H...3..8.a_..J..?4...y.N(..D.*h..g.jD..I...44Q?..N......oX.A......l...n?./..........$.!..;.^9"H........*...OkF....v.m_.e.v..f...."..bq{.....O.-....%R+...-..P.i..t5....2Z# ...#...,L..{..j..heT -=Z.P;...g.m)<owJ].J..../.p..8.u8.&..#.m9...j%..g&....g.x.I,....u.[....>./W...........*X...b*Z...ex.0..x.}.....Tb...[..H_M._.^N.d&...g._."@4N.pDs].GbT.......&p........Nw...%$=.....{..J.1....2....<E{..<!G..
                                                        C:\Users\user\AppData\Roaming\PEcoOLaILWJ.exe
                                                        Process:C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe
                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                        Category:dropped
                                                        Size (bytes):1105920
                                                        Entropy (8bit):7.366130613090411
                                                        Encrypted:false
                                                        SSDEEP:24576:7ba+A+AUUspAkNKhHP/+JY/5AUA8bWkb7:7IApAkYuJ85DW0
                                                        MD5:AFD45440CB1C77E2EBE1F2247573D04A
                                                        SHA1:36B35C3CA9DB092DD6A1CF157625475FA2226E05
                                                        SHA-256:BABF0FE64B0415F9EAABFA1AA91F1FBED20BC21BA93F3514F18FDC298D6CB54F
                                                        SHA-512:1C11CF324550A3198A75E5BDCC1FA0789EE8DBA2DFC90E8FF17280B5F2326DD6EA906BC9A6A387CE1C7E7875D5DB105CC2A2335A573E9FD4FDF07121EBEB5FD3
                                                        Malicious:true
                                                        Antivirus:
                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P.._..............0......D........... ........@.. .......................@............@....................................O........A................... ....................................................... ............... ..H............text...$.... ...................... ..`.rsrc....A.......B..................@..@.reloc....... ......................@..B........................H...........................8Y..........................................A...}.,.T..1..`4...N.Y-F..pU.TW..+R..Y.^.i...)..^9....3...).^....>.L..!.;.......i7.EG..>...+...tZL..._...^x....n.bK..R.(.b|..U!c.c....]^d.......<..$....|.us.1.3...%]..._...M.L...\}(`[.!`n.^."BU.S..h.C..n.D}...e.....l..^.<.........t.r..j9F..,..n...a.W.._7ZH.}...7.amqEB<.mp/.n_.w-...g.w.....O..W...w...).&.".%.d.........;t*...g.S.IC..T..Z-j.U...B?.)..+....e....e..q...T..%..7.xx.J.\.m>D*..

                                                        Static File Info

                                                        General

                                                        File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                        Entropy (8bit):7.366130613090411
                                                        TrID:
                                                        • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                        • Win32 Executable (generic) a (10002005/4) 49.75%
                                                        • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                        • Windows Screen Saver (13104/52) 0.07%
                                                        • Generic Win/DOS Executable (2004/3) 0.01%
                                                        File name:tn9jVPvlMSqAUX5.exe
                                                        File size:1105920
                                                        MD5:afd45440cb1c77e2ebe1f2247573d04a
                                                        SHA1:36b35c3ca9db092dd6a1cf157625475fa2226e05
                                                        SHA256:babf0fe64b0415f9eaabfa1aa91f1fbed20bc21ba93f3514f18fdc298d6cb54f
                                                        SHA512:1c11cf324550a3198a75e5bdcc1fa0789ee8dba2dfc90e8ff17280b5f2326dd6ea906bc9a6a387ce1c7e7875d5db105cc2a2335a573e9fd4fdf07121ebeb5fd3
                                                        SSDEEP:24576:7ba+A+AUUspAkNKhHP/+JY/5AUA8bWkb7:7IApAkYuJ85DW0
                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P.._..............0......D........... ........@.. .......................@............@................................

                                                        File Icon

                                                        Icon Hash:f8c492aaaa92dcfe

                                                        Static PE Info

                                                        General

                                                        Entrypoint:0x50b91e
                                                        Entrypoint Section:.text
                                                        Digitally signed:false
                                                        Imagebase:0x400000
                                                        Subsystem:windows gui
                                                        Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                        DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                        Time Stamp:0x5FB4A450 [Wed Nov 18 04:34:24 2020 UTC]
                                                        TLS Callbacks:
                                                        CLR (.Net) Version:v2.0.50727
                                                        OS Version Major:4
                                                        OS Version Minor:0
                                                        File Version Major:4
                                                        File Version Minor:0
                                                        Subsystem Version Major:4
                                                        Subsystem Version Minor:0
                                                        Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                        Entrypoint Preview

                                                        Instruction
                                                        jmp dword ptr [00402000h]
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al

                                                        Data Directories

                                                        NameVirtual AddressVirtual Size Is in Section
                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x10b8cc0x4f.text
                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x10c0000x41a8.rsrc
                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x1120000xc.reloc
                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                        Sections

                                                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                        .text0x20000x1099240x109a00False0.690261948529data7.37322926627IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                        .rsrc0x10c0000x41a80x4200False0.503373579545data5.44979825616IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .reloc0x1120000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                        Resources

                                                        NameRVASizeTypeLanguageCountry
                                                        RT_ICON0x10c1900x468GLS_BINARY_LSB_FIRST
                                                        RT_ICON0x10c5f80x10a8dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4275388049, next used block 4258479509
                                                        RT_ICON0x10d6a00x25a8dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 3771611807, next used block 3167566498
                                                        RT_GROUP_ICON0x10fc480x30data
                                                        RT_VERSION0x10fc780x344data
                                                        RT_MANIFEST0x10ffbc0x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                        Imports

                                                        DLLImport
                                                        mscoree.dll_CorExeMain

                                                        Version Infos

                                                        DescriptionData
                                                        Translation0x0000 0x04b0
                                                        LegalCopyrightCopyright 2017
                                                        Assembly Version1.0.0.0
                                                        InternalName.exe
                                                        FileVersion1.0.0.0
                                                        CompanyName
                                                        LegalTrademarks
                                                        Comments
                                                        ProductNameClinic Management System
                                                        ProductVersion1.0.0.0
                                                        FileDescriptionClinic Management System
                                                        OriginalFilename.exe

                                                        Network Behavior

                                                        Snort IDS Alerts

                                                        TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                        11/18/20-13:07:14.815072TCP2025019ET TROJAN Possible NanoCore C2 60B497434040192.168.2.423.105.131.229

                                                        Network Port Distribution

                                                        TCP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Nov 18, 2020 13:06:55.213327885 CET497374040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:06:58.221419096 CET497374040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:04.221538067 CET497374040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:14.434274912 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:14.791302919 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:14.791554928 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:14.815072060 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:15.291202068 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:15.351821899 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:15.360234976 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:15.700900078 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:15.701033115 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:16.191437960 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:16.191616058 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:16.691195965 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:16.710350037 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:16.710412025 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:16.710454941 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:16.710541964 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:16.721476078 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:16.721690893 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.161082983 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.161459923 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.161626101 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.162801981 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.171910048 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.172077894 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.172097921 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.172195911 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.172274113 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.172318935 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.172487020 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.172621965 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.561261892 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.562504053 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.562623978 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.563653946 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.573633909 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.573781967 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.574276924 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.577894926 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.578031063 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.578466892 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.578686953 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.578764915 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.579381943 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.579993963 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.580073118 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.580177069 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.580723047 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.580785036 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.581855059 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.582202911 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.582266092 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.584845066 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.594513893 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.594599009 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.974112988 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.975322008 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.975430012 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.976998091 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.977057934 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.977102995 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.977142096 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.987185001 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.987333059 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.987674952 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.987719059 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.987791061 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.987849951 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.987972975 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.988032103 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.989358902 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.997730017 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.997781038 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.997883081 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.998070002 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.998131990 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.998140097 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.998270035 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.998332977 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:17.999049902 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:17.999933958 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:18.000030994 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:18.072355032 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:18.092437983 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:18.092479944 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:18.092505932 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:18.092592955 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:18.092732906 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:18.092818975 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:18.092844963 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:18.092927933 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:18.092958927 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:18.093053102 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:18.093121052 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:18.093163013 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:18.093288898 CET40404974323.105.131.229192.168.2.4
                                                        Nov 18, 2020 13:07:18.093350887 CET497434040192.168.2.423.105.131.229
                                                        Nov 18, 2020 13:07:18.093390942 CET40404974323.105.131.229192.168.2.4

                                                        Code Manipulations

                                                        Statistics

                                                        Behavior

                                                        Click to jump to process

                                                        System Behavior

                                                        Analysis Process: tn9jVPvlMSqAUX5.exe PID: 6228 Parent PID: 5876

                                                        General

                                                        Start time:13:06:42
                                                        Start date:18/11/2020
                                                        Path:C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:'C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe'
                                                        Imagebase:0xf70000
                                                        File size:1105920 bytes
                                                        MD5 hash:AFD45440CB1C77E2EBE1F2247573D04A
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:.Net C# or VB.NET
                                                        Yara matches:
                                                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmp, Author: Florian Roth
                                                        • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmp, Author: Joe Security
                                                        • Rule: NanoCore, Description: unknown, Source: 00000000.00000002.680469030.0000000004A3C000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                        • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.679213235.00000000038CE000.00000004.00000001.sdmp, Author: Joe Security
                                                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.679941870.000000000488D000.00000004.00000001.sdmp, Author: Florian Roth
                                                        • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.679941870.000000000488D000.00000004.00000001.sdmp, Author: Joe Security
                                                        • Rule: NanoCore, Description: unknown, Source: 00000000.00000002.679941870.000000000488D000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                        Reputation:low

                                                        Analysis Process: schtasks.exe PID: 4812 Parent PID: 6228

                                                        General

                                                        Start time:13:06:51
                                                        Start date:18/11/2020
                                                        Path:C:\Windows\SysWOW64\schtasks.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\PEcoOLaILWJ' /XML 'C:\Users\user\AppData\Local\Temp\tmpECFC.tmp'
                                                        Imagebase:0x830000
                                                        File size:185856 bytes
                                                        MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high

                                                        Analysis Process: conhost.exe PID: 5108 Parent PID: 4812

                                                        General

                                                        Start time:13:06:51
                                                        Start date:18/11/2020
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff724c50000
                                                        File size:625664 bytes
                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high

                                                        Analysis Process: tn9jVPvlMSqAUX5.exe PID: 940 Parent PID: 6228

                                                        General

                                                        Start time:13:06:52
                                                        Start date:18/11/2020
                                                        Path:C:\Users\user\Desktop\tn9jVPvlMSqAUX5.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:{path}
                                                        Imagebase:0xde0000
                                                        File size:1105920 bytes
                                                        MD5 hash:AFD45440CB1C77E2EBE1F2247573D04A
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:.Net C# or VB.NET
                                                        Yara matches:
                                                        • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000004.00000003.808207077.0000000004A24000.00000004.00000001.sdmp, Author: Joe Security
                                                        Reputation:low

                                                        Analysis Process: vbc.exe PID: 5852 Parent PID: 940

                                                        General

                                                        Start time:13:07:37
                                                        Start date:18/11/2020
                                                        Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:'c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe' /shtml 'C:\Users\user\AppData\Local\Temp\43ogpuf5.fhl'
                                                        Imagebase:0x400000
                                                        File size:1171592 bytes
                                                        MD5 hash:C63ED21D5706A527419C9FBD730FFB2E
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 0000000C.00000002.774211357.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                                                        Reputation:high

                                                        Analysis Process: vbc.exe PID: 2228 Parent PID: 940

                                                        General

                                                        Start time:13:07:39
                                                        Start date:18/11/2020
                                                        Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:'c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe' /shtml 'C:\Users\user\AppData\Local\Temp\wsrpbxdq.ypo'
                                                        Imagebase:0x400000
                                                        File size:1171592 bytes
                                                        MD5 hash:C63ED21D5706A527419C9FBD730FFB2E
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000000D.00000002.779662410.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                                                        Reputation:high

                                                        Disassembly

                                                        Code Analysis

                                                        Reset < >