Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report DOC.exe

Overview

General Information

Sample Name:DOC.exe
Analysis ID:319643
MD5:6ad10f04afb24c96187b76129225c00c
SHA1:561fed791a4a4a10ec9889e3e30f0c4e0db80fd0
SHA256:c8d2f56a87705f11451e14e6ed7fe90a5b995b3e7f668811fb2f43a8f4325579
Tags:exeNanoCoreRAT

Most interesting Screenshot:

Detection

Nanocore
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected Nanocore Rat
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AntiVM_3
Yara detected Nanocore RAT
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Startup

  • System is w10x64
  • DOC.exe (PID: 6600 cmdline: 'C:\Users\user\Desktop\DOC.exe' MD5: 6AD10F04AFB24C96187B76129225C00C)
    • schtasks.exe (PID: 6696 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CZOIAvjovs' /XML 'C:\Users\user\AppData\Local\Temp\tmp3870.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 6704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • DOC.exe (PID: 6752 cmdline: {path} MD5: 6AD10F04AFB24C96187B76129225C00C)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
    00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
    • 0xfbbfd:$x1: NanoCore.ClientPluginHost
    • 0xfbc3a:$x2: IClientNetworkHost
    • 0xff76d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
    00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmpJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
      00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmpNanoCoreunknown Kevin Breen <kevin@techanarchy.net>
      • 0xfb965:$a: NanoCore
      • 0xfb975:$a: NanoCore
      • 0xfbba9:$a: NanoCore
      • 0xfbbbd:$a: NanoCore
      • 0xfbbfd:$a: NanoCore
      • 0xfb9c4:$b: ClientPlugin
      • 0xfbbc6:$b: ClientPlugin
      • 0xfbc06:$b: ClientPlugin
      • 0xfbaeb:$c: ProjectData
      • 0xfc4f2:$d: DESCrypto
      • 0x103ebe:$e: KeepAlive
      • 0x101eac:$g: LogClientMessage
      • 0xfe0a7:$i: get_Connected
      • 0xfc828:$j: #=q
      • 0xfc858:$j: #=q
      • 0xfc874:$j: #=q
      • 0xfc8a4:$j: #=q
      • 0xfc8c0:$j: #=q
      • 0xfc8dc:$j: #=q
      • 0xfc90c:$j: #=q
      • 0xfc928:$j: #=q
      00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
      • 0x250b1d:$x1: NanoCore.ClientPluginHost
      • 0x250b5a:$x2: IClientNetworkHost
      • 0x25468d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
      Click to see the 8 entries

      Sigma Overview

      System Summary:

      barindex
      Sigma detected: NanoCoreShow sources
      Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\DOC.exe, ProcessId: 6752, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
      Sigma detected: Scheduled temp file as task from temp locationShow sources
      Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CZOIAvjovs' /XML 'C:\Users\user\AppData\Local\Temp\tmp3870.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CZOIAvjovs' /XML 'C:\Users\user\AppData\Local\Temp\tmp3870.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\DOC.exe' , ParentImage: C:\Users\user\Desktop\DOC.exe, ParentProcessId: 6600, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CZOIAvjovs' /XML 'C:\Users\user\AppData\Local\Temp\tmp3870.tmp', ProcessId: 6696

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for dropped fileShow sources
      Source: C:\Users\user\AppData\Roaming\CZOIAvjovs.exeReversingLabs: Detection: 18%
      Source: C:\Users\user\AppData\Roaming\CZOIAvjovs.exeReversingLabs: Detection: 18%
      Multi AV Scanner detection for submitted fileShow sources
      Source: DOC.exeReversingLabs: Detection: 18%
      Source: DOC.exeReversingLabs: Detection: 18%
      Yara detected Nanocore RATShow sources
      Source: Yara matchFile source: 00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: DOC.exe PID: 6600, type: MEMORY
      Source: C:\Users\user\Desktop\DOC.exeCode function: 4x nop then jmp 05C45F32h
      Source: C:\Users\user\Desktop\DOC.exeCode function: 4x nop then jmp 05C45F32h

      Networking:

      barindex
      Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.7:49723 -> 23.105.131.162:4040
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.7:49723 -> 23.105.131.162:4040
      Source: global trafficTCP traffic: 192.168.2.7:49723 -> 23.105.131.162:4040
      Source: global trafficTCP traffic: 192.168.2.7:49723 -> 23.105.131.162:4040
      Source: Joe Sandbox ViewASN Name: LEASEWEB-USA-NYC-11US LEASEWEB-USA-NYC-11US
      Source: Joe Sandbox ViewASN Name: LEASEWEB-USA-NYC-11US LEASEWEB-USA-NYC-11US
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: unknownTCP traffic detected without corresponding DNS query: 23.105.131.162
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpString found in binary or memory: http://google.com
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmp, DOC.exe, 00000000.00000003.242124625.000000000541D000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
      Source: DOC.exe, 00000000.00000003.242614903.000000000541A000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
      Source: DOC.exe, 00000000.00000003.242614903.000000000541A000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comizey
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
      Source: DOC.exe, 00000000.00000003.242274345.000000000542D000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.como.Z
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
      Source: DOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com.TTFJ
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
      Source: DOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/f
      Source: DOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com0
      Source: DOC.exe, 00000000.00000003.244081653.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comF
      Source: DOC.exe, 00000000.00000002.257330031.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comFm.
      Source: DOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comcom
      Source: DOC.exe, 00000000.00000003.245481149.000000000542A000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comgretaJ
      Source: DOC.exe, 00000000.00000002.257330031.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comgrita9
      Source: DOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comlicdS
      Source: DOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comsiefx
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
      Source: DOC.exe, 00000000.00000003.241955458.000000000542D000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
      Source: DOC.exe, 00000000.00000003.244700687.000000000542A000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/
      Source: DOC.exe, 00000000.00000003.244700687.000000000542A000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/A
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmp, DOC.exe, 00000000.00000003.242988653.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/0
      Source: DOC.exe, 00000000.00000003.242988653.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/9
      Source: DOC.exe, 00000000.00000003.242988653.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Conn
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/J
      Source: DOC.exe, 00000000.00000003.243289341.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Regux
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/S
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Webd
      Source: DOC.exe, 00000000.00000003.243289341.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0so
      Source: DOC.exe, 00000000.00000003.242822237.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/anie
      Source: DOC.exe, 00000000.00000003.242988653.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/f
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/h
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
      Source: DOC.exe, 00000000.00000003.242988653.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/0
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/f
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/x
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
      Source: DOC.exe, 00000000.00000003.240828716.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comeuG
      Source: DOC.exe, 00000000.00000003.240828716.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comte?
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
      Source: DOC.exe, 00000000.00000003.242216750.000000000542C000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cnue
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpString found in binary or memory: http://google.com
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmp, DOC.exe, 00000000.00000003.242124625.000000000541D000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
      Source: DOC.exe, 00000000.00000003.242614903.000000000541A000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
      Source: DOC.exe, 00000000.00000003.242614903.000000000541A000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comizey
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
      Source: DOC.exe, 00000000.00000003.242274345.000000000542D000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.como.Z
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
      Source: DOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com.TTFJ
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
      Source: DOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/f
      Source: DOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com0
      Source: DOC.exe, 00000000.00000003.244081653.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comF
      Source: DOC.exe, 00000000.00000002.257330031.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comFm.
      Source: DOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comcom
      Source: DOC.exe, 00000000.00000003.245481149.000000000542A000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comgretaJ
      Source: DOC.exe, 00000000.00000002.257330031.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comgrita9
      Source: DOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comlicdS
      Source: DOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comsiefx
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
      Source: DOC.exe, 00000000.00000003.241955458.000000000542D000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
      Source: DOC.exe, 00000000.00000003.244700687.000000000542A000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/
      Source: DOC.exe, 00000000.00000003.244700687.000000000542A000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/A
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmp, DOC.exe, 00000000.00000003.242988653.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/0
      Source: DOC.exe, 00000000.00000003.242988653.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/9
      Source: DOC.exe, 00000000.00000003.242988653.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Conn
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/J
      Source: DOC.exe, 00000000.00000003.243289341.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Regux
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/S
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Webd
      Source: DOC.exe, 00000000.00000003.243289341.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0so
      Source: DOC.exe, 00000000.00000003.242822237.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/anie
      Source: DOC.exe, 00000000.00000003.242988653.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/f
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/h
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
      Source: DOC.exe, 00000000.00000003.242988653.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/0
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/f
      Source: DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/x
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
      Source: DOC.exe, 00000000.00000003.240828716.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comeuG
      Source: DOC.exe, 00000000.00000003.240828716.000000000542B000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comte?
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
      Source: DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
      Source: DOC.exe, 00000000.00000003.242216750.000000000542C000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cnue

      E-Banking Fraud:

      barindex
      Yara detected Nanocore RATShow sources
      Source: Yara matchFile source: 00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: DOC.exe PID: 6600, type: MEMORY

      System Summary:

      barindex
      Malicious sample detected (through community Yara rule)Show sources
      Source: 00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: Process Memory Space: DOC.exe PID: 6752, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: Process Memory Space: DOC.exe PID: 6600, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: Process Memory Space: DOC.exe PID: 6600, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: Process Memory Space: DOC.exe PID: 6752, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: Process Memory Space: DOC.exe PID: 6600, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: Process Memory Space: DOC.exe PID: 6600, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05BD1756 NtQuerySystemInformation,
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05BD1725 NtQuerySystemInformation,
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05BD1756 NtQuerySystemInformation,
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05BD1725 NtQuerySystemInformation,
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05161329
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05160B80
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_0516E7C0
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_051689E8
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05161C48
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05160098
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05168C80
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05162AF0
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05168318
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05161731
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05160B39
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05168328
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05161780
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_0516A1A8
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_051649D0
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05164BDA
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_051689D9
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_051649C2
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_051629F8
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05164BE8
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05168E11
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05163818
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05163808
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05164831
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05164840
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05168C70
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_0516947A
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05169488
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05C451D5
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05C43B83
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05C43FE7
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05161329
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05160B80
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_0516E7C0
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_051689E8
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05161C48
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05160098
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05168C80
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05162AF0
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05168318
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05161731
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05160B39
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05168328
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05161780
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_0516A1A8
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_051649D0
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05164BDA
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_051689D9
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_051649C2
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_051629F8
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05164BE8
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05168E11
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05163818
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05163808
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05164831
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05164840
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05168C70
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_0516947A
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05169488
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05C451D5
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05C43B83
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05C43FE7
      Source: DOC.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: CZOIAvjovs.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: DOC.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: CZOIAvjovs.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: DOC.exe, 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameB2B.exe4 vs DOC.exe
      Source: DOC.exe, 00000000.00000002.257133468.0000000005380000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs DOC.exe
      Source: DOC.exe, 00000000.00000002.258925636.00000000061B0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMARCUS.dll4 vs DOC.exe
      Source: DOC.exe, 00000000.00000000.239695576.00000000009A0000.00000002.00020000.sdmpBinary or memory string: OriginalFilename*Yd.exeR vs DOC.exe
      Source: DOC.exe, 00000000.00000002.259026086.00000000061E0000.00000002.00000001.sdmpBinary or memory string: originalfilename vs DOC.exe
      Source: DOC.exe, 00000000.00000002.259026086.00000000061E0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs DOC.exe
      Source: DOC.exe, 00000000.00000002.260831523.00000000076B0000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs DOC.exe
      Source: DOC.exe, 00000003.00000000.251653756.0000000000C00000.00000002.00020000.sdmpBinary or memory string: OriginalFilename*Yd.exeR vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameCoreClientPlugin.dll8 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameManagementClientPlugin.dll4 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNanoCoreBase.dll< vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameFileBrowserClient.dllT vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll4 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll@ vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNanoCoreStressTester.dll< vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNetworkClientPlugin.dll4 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSecurityClientPlugin.dll4 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameAForge.Video.DirectShow.dll4 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNAudio.dll4 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSurveillanceClientPlugin.dll4 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameToolsClientPlugin.dll4 vs DOC.exe
      Source: DOC.exeBinary or memory string: OriginalFilename*Yd.exeR vs DOC.exe
      Source: DOC.exe, 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameB2B.exe4 vs DOC.exe
      Source: DOC.exe, 00000000.00000002.257133468.0000000005380000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs DOC.exe
      Source: DOC.exe, 00000000.00000002.258925636.00000000061B0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMARCUS.dll4 vs DOC.exe
      Source: DOC.exe, 00000000.00000000.239695576.00000000009A0000.00000002.00020000.sdmpBinary or memory string: OriginalFilename*Yd.exeR vs DOC.exe
      Source: DOC.exe, 00000000.00000002.259026086.00000000061E0000.00000002.00000001.sdmpBinary or memory string: originalfilename vs DOC.exe
      Source: DOC.exe, 00000000.00000002.259026086.00000000061E0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs DOC.exe
      Source: DOC.exe, 00000000.00000002.260831523.00000000076B0000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs DOC.exe
      Source: DOC.exe, 00000003.00000000.251653756.0000000000C00000.00000002.00020000.sdmpBinary or memory string: OriginalFilename*Yd.exeR vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameCoreClientPlugin.dll8 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameManagementClientPlugin.dll4 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNanoCoreBase.dll< vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameFileBrowserClient.dllT vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll4 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll@ vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNanoCoreStressTester.dll< vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNetworkClientPlugin.dll4 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSecurityClientPlugin.dll4 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameAForge.Video.DirectShow.dll4 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNAudio.dll4 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSurveillanceClientPlugin.dll4 vs DOC.exe
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameToolsClientPlugin.dll4 vs DOC.exe
      Source: DOC.exeBinary or memory string: OriginalFilename*Yd.exeR vs DOC.exe
      Source: 00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: Process Memory Space: DOC.exe PID: 6752, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: Process Memory Space: DOC.exe PID: 6600, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: Process Memory Space: DOC.exe PID: 6600, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: Process Memory Space: DOC.exe PID: 6752, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: Process Memory Space: DOC.exe PID: 6600, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: Process Memory Space: DOC.exe PID: 6600, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: classification engineClassification label: mal100.troj.evad.winEXE@6/7@0/1
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05BD15DA AdjustTokenPrivileges,
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05BD15A3 AdjustTokenPrivileges,
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05BD15DA AdjustTokenPrivileges,
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05BD15A3 AdjustTokenPrivileges,
      Source: C:\Users\user\Desktop\DOC.exeFile created: C:\Users\user\AppData\Roaming\CZOIAvjovs.exeJump to behavior
      Source: C:\Users\user\Desktop\DOC.exeFile created: C:\Users\user\AppData\Roaming\CZOIAvjovs.exeJump to behavior
      Source: C:\Users\user\Desktop\DOC.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{dcac4b5d-9a8e-4643-8c5a-3d27f5de9c1d}
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6704:120:WilError_01
      Source: C:\Users\user\Desktop\DOC.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
      Source: C:\Users\user\Desktop\DOC.exeMutant created: \Sessions\1\BaseNamedObjects\JwXsFUTyQgmRAdZVtlXuPjQ
      Source: C:\Users\user\Desktop\DOC.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{dcac4b5d-9a8e-4643-8c5a-3d27f5de9c1d}
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6704:120:WilError_01
      Source: C:\Users\user\Desktop\DOC.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
      Source: C:\Users\user\Desktop\DOC.exeMutant created: \Sessions\1\BaseNamedObjects\JwXsFUTyQgmRAdZVtlXuPjQ
      Source: C:\Users\user\Desktop\DOC.exeFile created: C:\Users\user\AppData\Local\Temp\tmp3870.tmpJump to behavior
      Source: C:\Users\user\Desktop\DOC.exeFile created: C:\Users\user\AppData\Local\Temp\tmp3870.tmpJump to behavior
      Source: DOC.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: DOC.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\DOC.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
      Source: C:\Users\user\Desktop\DOC.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
      Source: C:\Users\user\Desktop\DOC.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
      Source: C:\Users\user\Desktop\DOC.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
      Source: C:\Users\user\Desktop\DOC.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
      Source: C:\Users\user\Desktop\DOC.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
      Source: C:\Users\user\Desktop\DOC.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
      Source: C:\Users\user\Desktop\DOC.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
      Source: C:\Users\user\Desktop\DOC.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
      Source: C:\Users\user\Desktop\DOC.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
      Source: C:\Users\user\Desktop\DOC.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
      Source: C:\Users\user\Desktop\DOC.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
      Source: C:\Users\user\Desktop\DOC.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\DOC.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\DOC.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
      Source: C:\Users\user\Desktop\DOC.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
      Source: DOC.exeReversingLabs: Detection: 18%
      Source: DOC.exeReversingLabs: Detection: 18%
      Source: DOC.exeString found in binary or memory: icons8-Add-16
      Source: DOC.exeString found in binary or memory: icons8-Add-16UW
      Source: DOC.exeString found in binary or memory: icons8-Add-16
      Source: DOC.exeString found in binary or memory: icons8-Add-16UW
      Source: C:\Users\user\Desktop\DOC.exeFile read: C:\Users\user\Desktop\DOC.exeJump to behavior
      Source: C:\Users\user\Desktop\DOC.exeFile read: C:\Users\user\Desktop\DOC.exeJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\DOC.exe 'C:\Users\user\Desktop\DOC.exe'
      Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CZOIAvjovs' /XML 'C:\Users\user\AppData\Local\Temp\tmp3870.tmp'
      Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: unknownProcess created: C:\Users\user\Desktop\DOC.exe {path}
      Source: C:\Users\user\Desktop\DOC.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CZOIAvjovs' /XML 'C:\Users\user\AppData\Local\Temp\tmp3870.tmp'
      Source: C:\Users\user\Desktop\DOC.exeProcess created: C:\Users\user\Desktop\DOC.exe {path}
      Source: unknownProcess created: C:\Users\user\Desktop\DOC.exe 'C:\Users\user\Desktop\DOC.exe'
      Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CZOIAvjovs' /XML 'C:\Users\user\AppData\Local\Temp\tmp3870.tmp'
      Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: unknownProcess created: C:\Users\user\Desktop\DOC.exe {path}
      Source: C:\Users\user\Desktop\DOC.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CZOIAvjovs' /XML 'C:\Users\user\AppData\Local\Temp\tmp3870.tmp'
      Source: C:\Users\user\Desktop\DOC.exeProcess created: C:\Users\user\Desktop\DOC.exe {path}
      Source: C:\Users\user\Desktop\DOC.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
      Source: C:\Users\user\Desktop\DOC.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
      Source: C:\Users\user\Desktop\DOC.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
      Source: C:\Users\user\Desktop\DOC.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
      Source: DOC.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
      Source: DOC.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
      Source: DOC.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
      Source: DOC.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
      Source: DOC.exeStatic file information: File size 1119744 > 1048576
      Source: DOC.exeStatic file information: File size 1119744 > 1048576
      Source: C:\Users\user\Desktop\DOC.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll
      Source: C:\Users\user\Desktop\DOC.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll
      Source: DOC.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x10d000
      Source: DOC.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x10d000
      Source: DOC.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
      Source: DOC.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
      Source: Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmp
      Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmp
      Source: Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmp
      Source: Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmp
      Source: Binary string: mscorrc.pdb source: DOC.exe, 00000000.00000002.257133468.0000000005380000.00000002.00000001.sdmp
      Source: Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmp
      Source: Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmp
      Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmp
      Source: Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmp
      Source: Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmp
      Source: Binary string: mscorrc.pdb source: DOC.exe, 00000000.00000002.257133468.0000000005380000.00000002.00000001.sdmp
      Source: Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmp
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_00892092 push eax; ret
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_0089270D push 00000019h; ret
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_0089272E push 00000019h; ret
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_00892050 push eax; ret
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05167053 push ss; ret
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_00892092 push eax; ret
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_0089270D push 00000019h; ret
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_0089272E push 00000019h; ret
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_00892050 push eax; ret
      Source: C:\Users\user\Desktop\DOC.exeCode function: 0_2_05167053 push ss; ret
      Source: initial sampleStatic PE information: section name: .text entropy: 7.38686348526
      Source: initial sampleStatic PE information: section name: .text entropy: 7.38686348526
      Source: initial sampleStatic PE information: section name: .text entropy: 7.38686348526
      Source: initial sampleStatic PE information: section name: .text entropy: 7.38686348526
      Source: C:\Users\user\Desktop\DOC.exeFile created: C:\Users\user\AppData\Roaming\CZOIAvjovs.exeJump to dropped file
      Source: C:\Users\user\Desktop\DOC.exeFile created: C:\Users\user\AppData\Roaming\CZOIAvjovs.exeJump to dropped file

      Boot Survival:

      barindex
      Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
      Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CZOIAvjovs' /XML 'C:\Users\user\AppData\Local\Temp\tmp3870.tmp'
      Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CZOIAvjovs' /XML 'C:\Users\user\AppData\Local\Temp\tmp3870.tmp'

      Hooking and other Techniques for Hiding and Protection:

      barindex
      Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
      Source: C:\Users\user\Desktop\DOC.exeFile opened: C:\Users\user\Desktop\DOC.exe:Zone.Identifier read attributes | delete
      Source: C:\Users\user\Desktop\DOC.exeFile opened: C:\Users\user\Desktop\DOC.exe:Zone.Identifier read attributes | delete
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\DOC.exeProcess information set: NOOPENFILEERRORBOX

      Malware Analysis System Evasion:

      barindex
      Yara detected AntiVM_3Show sources
      Source: Yara matchFile source: 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: DOC.exe PID: 6600, type: MEMORY
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLLX1
      Source: DOC.exe, 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
      Source: DOC.exe, 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAMEX1
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLLX1
      Source: DOC.exe, 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
      Source: DOC.exe, 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAMEX1
      Source: C:\Users\user\Desktop\DOC.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
      Source: C:\Users\user\Desktop\DOC.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
      Source: C:\Users\user\Desktop\DOC.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\DOC.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\DOC.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\DOC.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\DOC.exeWindow / User API: threadDelayed 1245
      Source: C:\Users\user\Desktop\DOC.exeWindow / User API: foregroundWindowGot 711
      Source: C:\Users\user\Desktop\DOC.exeWindow / User API: foregroundWindowGot 699
      Source: C:\Users\user\Desktop\DOC.exeWindow / User API: threadDelayed 1245
      Source: C:\Users\user\Desktop\DOC.exeWindow / User API: foregroundWindowGot 711
      Source: C:\Users\user\Desktop\DOC.exeWindow / User API: foregroundWindowGot 699
      Source: C:\Users\user\Desktop\DOC.exe TID: 6604Thread sleep time: -41500s >= -30000s
      Source: C:\Users\user\Desktop\DOC.exe TID: 6624Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Users\user\Desktop\DOC.exe TID: 6824Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Users\user\Desktop\DOC.exe TID: 6820Thread sleep time: -400000s >= -30000s
      Source: C:\Users\user\Desktop\DOC.exe TID: 6604Thread sleep time: -41500s >= -30000s
      Source: C:\Users\user\Desktop\DOC.exe TID: 6624Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Users\user\Desktop\DOC.exe TID: 6824Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Users\user\Desktop\DOC.exe TID: 6820Thread sleep time: -400000s >= -30000s
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: DOC.exe, 00000000.00000002.254062953.0000000003309000.00000004.00000001.sdmpBinary or memory string: VMware
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: vmwareX1
      Source: DOC.exe, 00000000.00000002.254062953.0000000003309000.00000004.00000001.sdmpBinary or memory string: VMWARE|9
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: q#"SOFTWARE\VMware, Inc.\VMware ToolsX1
      Source: DOC.exe, 00000003.00000003.277447400.00000000012BD000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: q&%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\X1
      Source: DOC.exe, 00000000.00000002.254062953.0000000003309000.00000004.00000001.sdmpBinary or memory string: VMware|9
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIX1
      Source: DOC.exe, 00000000.00000002.254062953.0000000003309000.00000004.00000001.sdmpBinary or memory string: VMware |9
      Source: DOC.exe, 00000000.00000002.254062953.0000000003309000.00000004.00000001.sdmpBinary or memory string: VMWARE
      Source: DOC.exe, 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: VMWAREX1
      Source: DOC.exe, 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
      Source: DOC.exe, 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
      Source: DOC.exe, 00000000.00000002.254062953.0000000003309000.00000004.00000001.sdmpBinary or memory string: VMware
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: QEMUX1
      Source: DOC.exe, 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
      Source: DOC.exe, 00000000.00000002.254062953.0000000003309000.00000004.00000001.sdmpBinary or memory string: VMware
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: vmwareX1
      Source: DOC.exe, 00000000.00000002.254062953.0000000003309000.00000004.00000001.sdmpBinary or memory string: VMWARE|9
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: q#"SOFTWARE\VMware, Inc.\VMware ToolsX1
      Source: DOC.exe, 00000003.00000003.277447400.00000000012BD000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: q&%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\X1
      Source: DOC.exe, 00000000.00000002.254062953.0000000003309000.00000004.00000001.sdmpBinary or memory string: VMware|9
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIX1
      Source: DOC.exe, 00000000.00000002.254062953.0000000003309000.00000004.00000001.sdmpBinary or memory string: VMware |9
      Source: DOC.exe, 00000000.00000002.254062953.0000000003309000.00000004.00000001.sdmpBinary or memory string: VMWARE
      Source: DOC.exe, 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: VMWAREX1
      Source: DOC.exe, 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
      Source: DOC.exe, 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
      Source: DOC.exe, 00000000.00000002.254062953.0000000003309000.00000004.00000001.sdmpBinary or memory string: VMware
      Source: DOC.exe, 00000000.00000002.253451433.0000000002F81000.00000004.00000001.sdmpBinary or memory string: QEMUX1
      Source: DOC.exe, 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
      Source: C:\Users\user\Desktop\DOC.exeProcess information queried: ProcessInformation
      Source: C:\Users\user\Desktop\DOC.exeProcess information queried: ProcessInformation
      Source: C:\Users\user\Desktop\DOC.exeProcess token adjusted: Debug
      Source: C:\Users\user\Desktop\DOC.exeProcess token adjusted: Debug
      Source: C:\Users\user\Desktop\DOC.exeProcess token adjusted: Debug
      Source: C:\Users\user\Desktop\DOC.exeProcess token adjusted: Debug
      Source: C:\Users\user\Desktop\DOC.exeMemory allocated: page read and write | page guard
      Source: C:\Users\user\Desktop\DOC.exeMemory allocated: page read and write | page guard

      HIPS / PFW / Operating System Protection Evasion:

      barindex
      Injects a PE file into a foreign processesShow sources
      Source: C:\Users\user\Desktop\DOC.exeMemory written: C:\Users\user\Desktop\DOC.exe base: 400000 value starts with: 4D5A
      Source: C:\Users\user\Desktop\DOC.exeMemory written: C:\Users\user\Desktop\DOC.exe base: 400000 value starts with: 4D5A
      Source: C:\Users\user\Desktop\DOC.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CZOIAvjovs' /XML 'C:\Users\user\AppData\Local\Temp\tmp3870.tmp'
      Source: C:\Users\user\Desktop\DOC.exeProcess created: C:\Users\user\Desktop\DOC.exe {path}
      Source: C:\Users\user\Desktop\DOC.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CZOIAvjovs' /XML 'C:\Users\user\AppData\Local\Temp\tmp3870.tmp'
      Source: C:\Users\user\Desktop\DOC.exeProcess created: C:\Users\user\Desktop\DOC.exe {path}
      Source: DOC.exe, 00000003.00000003.355684648.00000000012B0000.00000004.00000001.sdmpBinary or memory string: Program Manager
      Source: DOC.exe, 00000003.00000003.277447400.00000000012BD000.00000004.00000001.sdmpBinary or memory string: Program Manageresktop\
      Source: DOC.exe, 00000003.00000003.355684648.00000000012B0000.00000004.00000001.sdmpBinary or memory string: Program Manager
      Source: DOC.exe, 00000003.00000003.277447400.00000000012BD000.00000004.00000001.sdmpBinary or memory string: Program Manageresktop\
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\DOC.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
      Source: C:\Users\user\Desktop\DOC.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
      Source: C:\Users\user\Desktop\DOC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
      Source: C:\Users\user\Desktop\DOC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
      Source: C:\Users\user\Desktop\DOC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
      Source: C:\Users\user\Desktop\DOC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
      Source: C:\Users\user\Desktop\DOC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
      Source: C:\Users\user\Desktop\DOC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

      Stealing of Sensitive Information:

      barindex
      Yara detected Nanocore RATShow sources
      Source: Yara matchFile source: 00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: DOC.exe PID: 6600, type: MEMORY

      Remote Access Functionality:

      barindex
      Detected Nanocore RatShow sources
      Source: DOC.exe, 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmpString found in binary or memory: NanoCore.ClientPluginHost
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpString found in binary or memory: NanoCore.ClientPluginHost
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
      Source: DOC.exe, 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmpString found in binary or memory: NanoCore.ClientPluginHost
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpString found in binary or memory: NanoCore.ClientPluginHost
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
      Source: DOC.exe, 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
      Yara detected Nanocore RATShow sources
      Source: Yara matchFile source: 00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: DOC.exe PID: 6600, type: MEMORY

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management Instrumentation1Scheduled Task/Job1Access Token Manipulation1Masquerading1OS Credential DumpingSecurity Software Discovery221Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsCommand and Scripting Interpreter2Boot or Logon Initialization ScriptsProcess Injection112Virtualization/Sandbox Evasion3LSASS MemoryVirtualization/Sandbox Evasion3Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsScheduled Task/Job1Logon Script (Windows)Scheduled Task/Job1Disable or Modify Tools1Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationRemote Access Software1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Access Token Manipulation1NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptProcess Injection112LSA SecretsFile and Directory Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
      Replication Through Removable MediaLaunchdRc.commonRc.commonHidden Files and Directories1Cached Domain CredentialsSystem Information Discovery12VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsObfuscated Files or Information3DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobSoftware Packing1Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      DOC.exe19%ReversingLabs

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Users\user\AppData\Roaming\CZOIAvjovs.exe19%ReversingLabs

      Unpacked PE Files

      No Antivirus matches

      Domains

      No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      http://www.zhongyicts.com.cnue0%Avira URL Cloudsafe
      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/Webd0%Avira URL Cloudsafe
      http://www.jiyu-kobo.co.jp/jp/00%Avira URL Cloudsafe
      http://www.tiro.com0%URL Reputationsafe
      http://www.tiro.com0%URL Reputationsafe
      http://www.tiro.com0%URL Reputationsafe
      http://www.tiro.com0%URL Reputationsafe
      http://www.goodfont.co.kr0%URL Reputationsafe
      http://www.goodfont.co.kr0%URL Reputationsafe
      http://www.goodfont.co.kr0%URL Reputationsafe
      http://www.goodfont.co.kr0%URL Reputationsafe
      http://www.carterandcone.com0%URL Reputationsafe
      http://www.carterandcone.com0%URL Reputationsafe
      http://www.carterandcone.com0%URL Reputationsafe
      http://www.carterandcone.com0%URL Reputationsafe
      http://www.sajatypeworks.com0%URL Reputationsafe
      http://www.sajatypeworks.com0%URL Reputationsafe
      http://www.sajatypeworks.com0%URL Reputationsafe
      http://www.sajatypeworks.com0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/90%Avira URL Cloudsafe
      http://www.typography.netD0%URL Reputationsafe
      http://www.typography.netD0%URL Reputationsafe
      http://www.typography.netD0%URL Reputationsafe
      http://www.typography.netD0%URL Reputationsafe
      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
      http://fontfabrik.com0%URL Reputationsafe
      http://fontfabrik.com0%URL Reputationsafe
      http://fontfabrik.com0%URL Reputationsafe
      http://fontfabrik.com0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/jp/f0%Avira URL Cloudsafe
      http://www.fontbureau.comcom0%URL Reputationsafe
      http://www.fontbureau.comcom0%URL Reputationsafe
      http://www.fontbureau.comcom0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/00%Avira URL Cloudsafe
      http://www.fontbureau.com00%Avira URL Cloudsafe
      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
      http://www.sandoll.co.kr0%URL Reputationsafe
      http://www.sandoll.co.kr0%URL Reputationsafe
      http://www.sandoll.co.kr0%URL Reputationsafe
      http://www.urwpp.deDPlease0%URL Reputationsafe
      http://www.urwpp.deDPlease0%URL Reputationsafe
      http://www.urwpp.deDPlease0%URL Reputationsafe
      http://www.zhongyicts.com.cn0%URL Reputationsafe
      http://www.zhongyicts.com.cn0%URL Reputationsafe
      http://www.zhongyicts.com.cn0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/Regux0%Avira URL Cloudsafe
      http://www.sakkal.com0%URL Reputationsafe
      http://www.sakkal.com0%URL Reputationsafe
      http://www.sakkal.com0%URL Reputationsafe
      http://www.carterandcone.como.Z0%Avira URL Cloudsafe
      http://www.galapagosdesign.com/0%URL Reputationsafe
      http://www.galapagosdesign.com/0%URL Reputationsafe
      http://www.galapagosdesign.com/0%URL Reputationsafe
      http://www.fontbureau.comF0%URL Reputationsafe
      http://www.fontbureau.comF0%URL Reputationsafe
      http://www.fontbureau.comF0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/S0%Avira URL Cloudsafe
      http://www.sajatypeworks.comeuG0%Avira URL Cloudsafe
      http://www.jiyu-kobo.co.jp/J0%Avira URL Cloudsafe
      http://www.galapagosdesign.com/A0%Avira URL Cloudsafe
      http://www.fontbureau.comsiefx0%Avira URL Cloudsafe
      http://www.fontbureau.comlicdS0%Avira URL Cloudsafe
      http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/Conn0%Avira URL Cloudsafe
      http://www.carterandcone.coml0%URL Reputationsafe
      http://www.carterandcone.coml0%URL Reputationsafe
      http://www.carterandcone.coml0%URL Reputationsafe
      http://www.fontbureau.com.TTFJ0%Avira URL Cloudsafe
      http://www.founder.com.cn/cn/0%URL Reputationsafe
      http://www.founder.com.cn/cn/0%URL Reputationsafe
      http://www.founder.com.cn/cn/0%URL Reputationsafe
      http://www.carterandcone.comizey0%Avira URL Cloudsafe
      http://www.founder.com.cn/cn0%URL Reputationsafe
      http://www.founder.com.cn/cn0%URL Reputationsafe
      http://www.founder.com.cn/cn0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/x0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/x0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/x0%URL Reputationsafe
      http://www.sajatypeworks.comte?0%Avira URL Cloudsafe
      http://www.jiyu-kobo.co.jp/anie0%Avira URL Cloudsafe
      http://www.jiyu-kobo.co.jp/Y0so0%Avira URL Cloudsafe
      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe

      Domains and IPs

      Contacted Domains

      No contacted domains info

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://www.zhongyicts.com.cnueDOC.exe, 00000000.00000003.242216750.000000000542C000.00000004.00000001.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.fontbureau.com/designersGDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
        		high
        http://www.fontbureau.com/designers/?DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
          		high
          http://www.founder.com.cn/cn/bTheDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
          • URL Reputation: safe
          • URL Reputation: safe
          • URL Reputation: safe
          • URL Reputation: safe
          		unknown
          http://www.fontbureau.com/designers?DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
            		high
            http://www.jiyu-kobo.co.jp/WebdDOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.jiyu-kobo.co.jp/jp/0DOC.exe, 00000000.00000003.242988653.0000000005426000.00000004.00000001.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.tiro.comDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
            • URL Reputation: safe
            • URL Reputation: safe
            • URL Reputation: safe
            • URL Reputation: safe
            		unknown
            http://www.fontbureau.com/designersDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
              		high
              http://www.goodfont.co.krDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://www.carterandcone.comDOC.exe, 00000000.00000003.242614903.000000000541A000.00000004.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://www.sajatypeworks.comDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://www.jiyu-kobo.co.jp/9DOC.exe, 00000000.00000003.242988653.0000000005426000.00000004.00000001.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.typography.netDDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://www.founder.com.cn/cn/cTheDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://www.galapagosdesign.com/staff/dennis.htmDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://fontfabrik.comDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://www.jiyu-kobo.co.jp/jp/fDOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.fontbureau.comcomDOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://www.jiyu-kobo.co.jp/0DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.fontbureau.com0DOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.galapagosdesign.com/DPleaseDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://www.jiyu-kobo.co.jp/Y0DOC.exe, 00000000.00000003.243289341.0000000005426000.00000004.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://www.fonts.comDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
                		high
                http://www.sandoll.co.krDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.urwpp.deDPleaseDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.zhongyicts.com.cnDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.jiyu-kobo.co.jp/ReguxDOC.exe, 00000000.00000003.243289341.0000000005426000.00000004.00000001.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://www.sakkal.comDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.carterandcone.como.ZDOC.exe, 00000000.00000003.242274345.000000000542D000.00000004.00000001.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://www.apache.org/licenses/LICENSE-2.0DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmp, DOC.exe, 00000000.00000003.242124625.000000000541D000.00000004.00000001.sdmpfalse
                  		high
                  http://www.fontbureau.comDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
                    		high
                    http://www.galapagosdesign.com/DOC.exe, 00000000.00000003.244700687.000000000542A000.00000004.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    		unknown
                    http://www.fontbureau.comFDOC.exe, 00000000.00000003.244081653.0000000005426000.00000004.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    		unknown
                    http://www.jiyu-kobo.co.jp/SDOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.fontbureau.com/fDOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpfalse
                      		high
                      http://www.sajatypeworks.comeuGDOC.exe, 00000000.00000003.240828716.000000000542B000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.jiyu-kobo.co.jp/JDOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.galapagosdesign.com/ADOC.exe, 00000000.00000003.244700687.000000000542A000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.fontbureau.comsiefxDOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.fontbureau.comlicdSDOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.jiyu-kobo.co.jp/jp/DOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.jiyu-kobo.co.jp/ConnDOC.exe, 00000000.00000003.242988653.0000000005426000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.carterandcone.comlDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.fontbureau.com.TTFJDOC.exe, 00000000.00000003.244365755.000000000542B000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.founder.com.cn/cn/DOC.exe, 00000000.00000003.241955458.000000000542D000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.carterandcone.comizeyDOC.exe, 00000000.00000003.242614903.000000000541A000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.fontbureau.com/designers/cabarga.htmlNDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
                        		high
                        http://www.founder.com.cn/cnDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.jiyu-kobo.co.jp/xDOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designers/frere-jones.htmlDOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
                          		high
                          http://www.sajatypeworks.comte?DOC.exe, 00000000.00000003.240828716.000000000542B000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.jiyu-kobo.co.jp/anieDOC.exe, 00000000.00000003.242822237.0000000005426000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.jiyu-kobo.co.jp/Y0soDOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.jiyu-kobo.co.jp/DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmp, DOC.exe, 00000000.00000003.242988653.0000000005426000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designers8DOC.exe, 00000000.00000002.257492311.0000000005622000.00000004.00000001.sdmpfalse
                            		high
                            http://www.fontbureau.comgrita9DOC.exe, 00000000.00000002.257330031.0000000005426000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/hDOC.exe, 00000000.00000003.243551878.0000000005426000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.comFm.DOC.exe, 00000000.00000002.257330031.0000000005426000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/fDOC.exe, 00000000.00000003.242988653.0000000005426000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fontbureau.comgretaJDOC.exe, 00000000.00000003.245481149.000000000542A000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown

                            Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public

                            IPDomainCountryFlagASNASN NameMalicious
                            23.105.131.162
                            		unknownUnited States
                            		396362LEASEWEB-USA-NYC-11UStrue

                            General Information

                            Joe Sandbox Version:31.0.0 Red Diamond
                            Analysis ID:319643
                            Start date:18.11.2020
                            Start time:14:12:30
                            Joe Sandbox Product:CloudBasic
                            Overall analysis duration:0h 6m 24s
                            Hypervisor based Inspection enabled:false
                            Report type:light
                            Sample file name:DOC.exe
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                            Number of analysed new started processes analysed:24
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • HDC enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Detection:MAL
                            Classification:mal100.troj.evad.winEXE@6/7@0/1
                            EGA Information:Failed
                            HDC Information:
                            • Successful, ratio: 14.3% (good quality ratio 8.7%)
                            • Quality average: 38.1%
                            • Quality standard deviation: 36.2%
                            HCA Information:
                            • Successful, ratio: 79%
                            • Number of executed functions: 0
                            • Number of non-executed functions: 0
                            Cookbook Comments:
                            • Adjust boot time
                            • Enable AMSI
                            • Found application associated with file extension: .exe
                            Warnings:
                            Show All
                            • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                            • TCP Packets have been reduced to 100
                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                            • Report size getting too big, too many NtOpenKeyEx calls found.
                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            14:13:27API Interceptor1016x Sleep call for process: DOC.exe modified

                            Joe Sandbox View / Context

                            IPs

                            No context

                            Domains

                            No context

                            ASN

                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                            LEASEWEB-USA-NYC-11USShipping_Details.exeGet hashmaliciousBrowse
                            • 23.105.131.165
                            2AyWKsCvVF.exeGet hashmaliciousBrowse
                            • 192.253.246.143
                            tn9jVPvlMSqAUX5.exeGet hashmaliciousBrowse
                            • 23.105.131.229
                            HLiw2LPA8i.rtfGet hashmaliciousBrowse
                            • 192.253.246.143
                            TDToxqrclL.exeGet hashmaliciousBrowse
                            • 23.105.131.177
                            Ziiq5tI3CT.exeGet hashmaliciousBrowse
                            • 23.105.131.239
                            f3wo2FuLN6.exeGet hashmaliciousBrowse
                            • 192.253.246.143
                            ORDER INQUIRY.pdf.exeGet hashmaliciousBrowse
                            • 23.105.131.177
                            Purchase Order 4500033557.pdf.exeGet hashmaliciousBrowse
                            • 23.105.131.177
                            SecuriteInfo.com.Trojan.DownLoader35.34609.25775.exeGet hashmaliciousBrowse
                            • 192.253.246.138
                            Proof_of_payment.xlsmGet hashmaliciousBrowse
                            • 23.105.131.217
                            invoice tax.xlsmGet hashmaliciousBrowse
                            • 23.105.131.217
                            SHIPPING DOCUMENTS.pdf.exeGet hashmaliciousBrowse
                            • 23.105.131.177
                            Payment_Order_20201111.xlsxGet hashmaliciousBrowse
                            • 192.253.246.138
                            TLpMnhJmg7.exeGet hashmaliciousBrowse
                            • 192.253.246.143
                            HDyADDoI3I.exeGet hashmaliciousBrowse
                            • 192.253.246.143
                            11.exeGet hashmaliciousBrowse
                            • 173.234.155.145
                            53C29QAJnd.exeGet hashmaliciousBrowse
                            • 173.234.155.145
                            OMQZvmAmCj.exeGet hashmaliciousBrowse
                            • 173.234.155.145
                            gH4o5FCHAE.exeGet hashmaliciousBrowse
                            • 173.234.155.145

                            JA3 Fingerprints

                            No context

                            Dropped Files

                            No context

                            Created / dropped Files

                            C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\DOC.exe.log
                            Process:C:\Users\user\Desktop\DOC.exe
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):641
                            Entropy (8bit):5.271473536084351
                            Encrypted:false
                            SSDEEP:12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk70U2u7x5I6Hi0Ug+9Yz9tv:MLF20NaL329hJ5g522rW2I3rOz2T
                            MD5:C3EC08CD6BEA8576070D5A52B4B6D7D0
                            SHA1:40B95253F98B3CC5953100C0E71DAC7915094A5A
                            SHA-256:28B314C3E5651414FD36B2A65B644A2A55F007A34A536BE17514E12CEE5A091B
                            SHA-512:5B0E6398A092F08240DC6765425E16DB52F32542FF7250E87403C407E54B3660EF93E0EAD17BA2CEF6B666951ACF66FA0EAD61FB52E80867DDD398E8258DED22
                            Malicious:true
                            Reputation:moderate, very likely benign file
                            Preview: 1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\d05d469d89b319a068f2123e7e6f8621\System.Web.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..
                            C:\Users\user\AppData\Local\Temp\tmp3870.tmp
                            Process:C:\Users\user\Desktop\DOC.exe
                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):1659
                            Entropy (8bit):5.176378890983135
                            Encrypted:false
                            SSDEEP:24:2dH4+SEqC/dp7hdMlNMFpdU/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBAqPMtn:cbhH7MlNQ8/rydbz9I3YODOLNdq32
                            MD5:8D3271AEF7B24B0FBA2824A6FDCB3175
                            SHA1:BB1BE4542A6924BB767F5E2929ED3724E31F566B
                            SHA-256:481AD806BE0C55F5D357C2196FA5C451CC9529106116DA6D070BD5BCE626B072
                            SHA-512:45A249B869B041FBCA277F07722997D600028546953F80643137980FDDB268FFAC44E1AD65BB2FA07F6C32C2B7B4C9003DDD6FF701C4196158258C87337CD3E0
                            Malicious:true
                            Reputation:low
                            Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAv
                            C:\Users\user\AppData\Roaming\CZOIAvjovs.exe
                            Process:C:\Users\user\Desktop\DOC.exe
                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                            Category:dropped
                            Size (bytes):1119744
                            Entropy (8bit):7.3796673297276865
                            Encrypted:false
                            SSDEEP:12288:ZivDqJF9EWc+ylc3UognpsVjxonj4GdnfKM3yvt8LFOcc6WkFRJtsbUpmmEvx74F:cuJFHJipkj+nkGdnf73y18bWkbzswH
                            MD5:6AD10F04AFB24C96187B76129225C00C
                            SHA1:561FED791A4A4A10EC9889E3E30F0C4E0DB80FD0
                            SHA-256:C8D2F56A87705F11451E14E6ED7FE90A5B995B3E7F668811FB2F43A8F4325579
                            SHA-512:622A5C80012D121D765DC57436F06B321379AED457DB210ECAF68ABFD2E6462F2A20FF16ABE948014C6E3B060D4A62E087A3BF0AB6E7A83CE76C34B216678302
                            Malicious:true
                            Antivirus:
                            • Antivirus: ReversingLabs, Detection: 19%
                            Reputation:low
                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....._..............0......D......^.... ........@.. ....................................@.....................................W........A...................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc....A.......B..................@..@.reloc.......`......................@..B................@.......H....... 6................. ..............................................S.DMy.4.Y....g5'............jT.......=...!rXF.T.yI..XB..6P.EQ..;..e....m...:......gy..SP.g.[...C....#.6.......F..u,....Zk6...X.....sm.Y>.H.L...S..5.O..a>.-.<w.....w.#.....:.=.w.@.X....Vi..e5...'e....Pl7G....i.....p1lE...]..R....K..f..UqO...^..X3..n.t......%.v..\.b.-.....Xp..@.Hn...Lq...*..;."K.....#Q.H1...M.W.......>...i.\.#.._y...a.....l..6...AO.*G...\S.3m..J...<Hp.f........W
                            C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat
                            Process:C:\Users\user\Desktop\DOC.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):232
                            Entropy (8bit):7.024371743172393
                            Encrypted:false
                            SSDEEP:6:X4LDAnybgCFcpJSQwP4d7ZrqJgTFwoaw+9XU4:X4LEnybgCFCtvd7ZrCgpwoaw+Z9
                            MD5:32D0AAE13696FF7F8AF33B2D22451028
                            SHA1:EF80C4E0DB2AE8EF288027C9D3518E6950B583A4
                            SHA-256:5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
                            SHA-512:1D77FC13512C0DBC4EFD7A66ACB502481E4EFA0FB73D0C7D0942448A72B9B05BA1EA78DDF0BE966363C2E3122E0B631DB7630D044D08C1E1D32B9FB025C356A5
                            Malicious:false
                            Reputation:moderate, very likely benign file
                            Preview: Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.
                            C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
                            Process:C:\Users\user\Desktop\DOC.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):8
                            Entropy (8bit):3.0
                            Encrypted:false
                            SSDEEP:3:mqh:mC
                            MD5:FCDEA6ED59DF2E5154B0CF3F084BF8DF
                            SHA1:B8C1743A845038E38892E7CA8240FC2C68EF443E
                            SHA-256:07D3164F04628B1D3D1819E04C0C0AE83FD6DC72199976349A0956152091C478
                            SHA-512:FEB7ABF35FD28E282C7E76C1A68338A0DE2C8D8B9B13A771A16EDD6C1D1E811F14602A26C1D50624F6030AA9241E472E12B618386A6ADD90DB48930671D24423
                            Malicious:true
                            Reputation:low
                            Preview: .../...H
                            C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bin
                            Process:C:\Users\user\Desktop\DOC.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):40
                            Entropy (8bit):5.221928094887364
                            Encrypted:false
                            SSDEEP:3:9bzY6oRDMjmPl:RzWDMCd
                            MD5:AE0F5E6CE7122AF264EC533C6B15A27B
                            SHA1:1265A495C42EED76CC043D50C60C23297E76CCE1
                            SHA-256:73B0B92179C61C26589B47E9732CE418B07EDEE3860EE5A2A5FB06F3B8AA9B26
                            SHA-512:DD44C2D24D4E3A0F0B988AD3D04683B5CB128298043134649BBE33B2512CE0C9B1A8E7D893B9F66FBBCDD901E2B0646C4533FB6C0C8C4AFCB95A0EFB95D446F8
                            Malicious:false
                            Reputation:moderate, very likely benign file
                            Preview: 9iH...}Z.4..f..... 8.j....|.&X..e.F.*.
                            C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\storage.dat
                            Process:C:\Users\user\Desktop\DOC.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):426840
                            Entropy (8bit):7.999608491116724
                            Encrypted:true
                            SSDEEP:12288:zKf137EiDsTjevgA4p0V7njXuWSvdVU7V4OC0Rr:+134i2lp67i5d8+OCg
                            MD5:963D5E2C9C0008DFF05518B47C367A7F
                            SHA1:C183D601FABBC9AC8FBFA0A0937DECC677535E74
                            SHA-256:5EACF2974C9BB2C2E24CDC651C4840DD6F4B76A98F0E85E90279F1DBB2E6F3C0
                            SHA-512:0C04E1C1A13070D48728D9F7F300D9B26DEC6EC8875D8D3017EAD52B9EE5BDF9B651A7F0FCC537761212831107646ED72B8ED017E7477E600BC0137EF857AE2C
                            Malicious:false
                            Reputation:moderate, very likely benign file
                            Preview: ..g&jo...IPg...GM....R>i...o...I.>.&.r{....8...}...E....v.!7.u3e.. .....db...}.......".t(.xC9.cp.B....7...'.......%......w.^.._.......B.W%.<..i.0.{9.xS...5...)..w..$..C..?`F..u.5.T.X.w'Si..z.n{...Y!m...RA...xg....[7...z..9@.K.-...T..+.ACe....R....enO.....AoNMT.\^....}H&..4I...B.:..@..J...v..rI5..kP......2j....B..B.~.T..>.c..emW;Rn<9..[.r.o....R[....@=...:...L.g<.....I..%4[.G^.~.l'......v.p&.........+..S...9d/.{..H.`@.1..........f.\s...X.a.].<.h*...J4*...k.x....%3.......3.c..?%....>.!.}..)(.{...H...3..`'].Q.[sN..JX(.%pH....+......(...v.....H...3..8.a_..J..?4...y.N(..D.*h..g.jD..I...44Q?..N......oX.A......l...n?./..........$.!..;.^9"H........*...OkF....v.m_.e.v..f...."..bq{.....O.-....%R+...-..P.i..t5....2Z# ...#...,L..{..j..heT -=Z.P;...g.m)<owJ].J..../.p..8.u8.&..#.m9...j%..g&....g.x.I,....u.[....>./W...........*X...b*Z...ex.0..x.}.....Tb...[..H_M._.^N.d&...g._."@4N.pDs].GbT.......&p........Nw...%$=.....{..J.1....2....<E{..<!G..

                            Static File Info

                            General

                            File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                            Entropy (8bit):7.3796673297276865
                            TrID:
                            • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                            • Win32 Executable (generic) a (10002005/4) 49.75%
                            • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                            • Windows Screen Saver (13104/52) 0.07%
                            • Generic Win/DOS Executable (2004/3) 0.01%
                            File name:DOC.exe
                            File size:1119744
                            MD5:6ad10f04afb24c96187b76129225c00c
                            SHA1:561fed791a4a4a10ec9889e3e30f0c4e0db80fd0
                            SHA256:c8d2f56a87705f11451e14e6ed7fe90a5b995b3e7f668811fb2f43a8f4325579
                            SHA512:622a5c80012d121d765dc57436f06b321379aed457db210ecaf68abfd2e6462f2a20ff16abe948014c6e3b060d4a62e087a3bf0ab6e7a83ce76c34b216678302
                            SSDEEP:12288:ZivDqJF9EWc+ylc3UognpsVjxonj4GdnfKM3yvt8LFOcc6WkFRJtsbUpmmEvx74F:cuJFHJipkj+nkGdnf73y18bWkbzswH
                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......_..............0......D......^.... ........@.. ....................................@................................

                            File Icon

                            Icon Hash:f8c492aaaa92dcfe

                            Static PE Info

                            General

                            Entrypoint:0x50ee5e
                            Entrypoint Section:.text
                            Digitally signed:false
                            Imagebase:0x400000
                            Subsystem:windows gui
                            Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                            DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                            Time Stamp:0x5FB4A4C5 [Wed Nov 18 04:36:21 2020 UTC]
                            TLS Callbacks:
                            CLR (.Net) Version:v2.0.50727
                            OS Version Major:4
                            OS Version Minor:0
                            File Version Major:4
                            File Version Minor:0
                            Subsystem Version Major:4
                            Subsystem Version Minor:0
                            Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                            Entrypoint Preview

                            Instruction
                            jmp dword ptr [00402000h]
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al
                            add byte ptr [eax], al

                            Data Directories

                            NameVirtual AddressVirtual Size Is in Section
                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_IMPORT0x10ee040x57.text
                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x1100000x41a8.rsrc
                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x1160000xc.reloc
                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                            Sections

                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                            .text0x20000x10ce640x10d000False0.694431234026data7.38686348526IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                            .rsrc0x1100000x41a80x4200False0.503432765152data5.45039345339IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                            .reloc0x1160000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                            Resources

                            NameRVASizeTypeLanguageCountry
                            RT_ICON0x1101900x468GLS_BINARY_LSB_FIRST
                            RT_ICON0x1105f80x10a8dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4275388049, next used block 4258479509
                            RT_ICON0x1116a00x25a8dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 3771611807, next used block 3167566498
                            RT_GROUP_ICON0x113c480x30data
                            RT_VERSION0x113c780x344data
                            RT_MANIFEST0x113fbc0x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                            Imports

                            DLLImport
                            mscoree.dll_CorExeMain

                            Version Infos

                            DescriptionData
                            Translation0x0000 0x04b0
                            LegalCopyrightCopyright 2017
                            Assembly Version1.0.0.0
                            InternalNamed.exe
                            FileVersion1.0.0.0
                            CompanyName
                            LegalTrademarks
                            Comments
                            ProductNameClinic Management System
                            ProductVersion1.0.0.0
                            FileDescriptionClinic Management System
                            OriginalFilenamed.exe

                            Network Behavior

                            Snort IDS Alerts

                            TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                            11/18/20-14:13:34.045618TCP2025019ET TROJAN Possible NanoCore C2 60B497234040192.168.2.723.105.131.162

                            Network Port Distribution

                            TCP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Nov 18, 2020 14:13:33.600183010 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:34.005378008 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:34.005552053 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:34.045618057 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:34.496907949 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:34.525669098 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:34.974037886 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:35.205224037 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:35.245909929 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:35.658174992 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:35.685698986 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:36.186507940 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.497425079 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.499332905 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.499439001 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:36.508373976 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.508555889 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.508594036 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.508697033 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:36.508867025 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.508979082 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:36.515528917 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.518650055 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.518789053 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.518896103 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:36.519356012 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.520392895 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:36.922518015 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.924273014 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.924427032 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:36.925810099 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.927284956 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.927381039 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:36.941277981 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.950264931 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.950380087 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:36.952456951 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.952718019 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.952824116 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:36.956509113 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.969232082 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.969285011 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.969333887 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:36.969424963 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.969526052 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:36.969541073 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.975753069 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.978308916 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:36.978502035 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.980390072 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.980462074 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:36.980479956 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.982404947 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.982477903 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:36.985758066 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.988337040 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:36.988409996 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:37.379363060 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.381352901 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.381527901 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:37.383512020 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.392493010 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.392658949 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.392733097 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:37.396400928 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.396483898 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:37.398395061 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.402513027 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.402565002 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.402647972 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:37.411446095 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.411521912 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.411577940 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:37.411645889 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.411701918 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:37.415158033 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.418374062 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.418505907 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:37.421237946 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.439531088 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.439574957 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.439678907 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:37.439692020 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.439747095 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:37.439862013 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.439968109 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.440030098 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:37.440036058 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.442368984 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.442516088 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:37.452541113 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.456428051 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.456577063 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:37.458225965 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.462277889 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.462379932 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:37.468354940 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.468463898 CET40404972323.105.131.162192.168.2.7
                            Nov 18, 2020 14:13:37.468532085 CET497234040192.168.2.723.105.131.162
                            Nov 18, 2020 14:13:37.475269079 CET40404972323.105.131.162192.168.2.7

                            Code Manipulations

                            Statistics

                            Behavior

                            Click to jump to process

                            System Behavior

                            Analysis Process: DOC.exe PID: 6600 Parent PID: 5724

                            General

                            Start time:14:13:24
                            Start date:18/11/2020
                            Path:C:\Users\user\Desktop\DOC.exe
                            Wow64 process (32bit):true
                            Commandline:'C:\Users\user\Desktop\DOC.exe'
                            Imagebase:0x890000
                            File size:1119744 bytes
                            MD5 hash:6AD10F04AFB24C96187B76129225C00C
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:.Net C# or VB.NET
                            Yara matches:
                            • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.253582659.0000000002FFC000.00000004.00000001.sdmp, Author: Joe Security
                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmp, Author: Florian Roth
                            • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmp, Author: Joe Security
                            • Rule: NanoCore, Description: unknown, Source: 00000000.00000002.254195888.0000000003FBD000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmp, Author: Florian Roth
                            • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmp, Author: Joe Security
                            • Rule: NanoCore, Description: unknown, Source: 00000000.00000002.255252413.0000000004173000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                            Reputation:low

                            Analysis Process: schtasks.exe PID: 6696 Parent PID: 6600

                            General

                            Start time:14:13:29
                            Start date:18/11/2020
                            Path:C:\Windows\SysWOW64\schtasks.exe
                            Wow64 process (32bit):true
                            Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\CZOIAvjovs' /XML 'C:\Users\user\AppData\Local\Temp\tmp3870.tmp'
                            Imagebase:0xf00000
                            File size:185856 bytes
                            MD5 hash:15FF7D8324231381BAD48A052F85DF04
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high

                            Analysis Process: conhost.exe PID: 6704 Parent PID: 6696

                            General

                            Start time:14:13:29
                            Start date:18/11/2020
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff774ee0000
                            File size:625664 bytes
                            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high

                            Analysis Process: DOC.exe PID: 6752 Parent PID: 6600

                            General

                            Start time:14:13:30
                            Start date:18/11/2020
                            Path:C:\Users\user\Desktop\DOC.exe
                            Wow64 process (32bit):true
                            Commandline:{path}
                            Imagebase:0xaf0000
                            File size:1119744 bytes
                            MD5 hash:6AD10F04AFB24C96187B76129225C00C
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:.Net C# or VB.NET
                            Yara matches:
                            • Rule: NanoCore, Description: unknown, Source: 00000003.00000003.270319895.000000000477B000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                            Reputation:low

                            Disassembly

                            Code Analysis

                            Reset < >