Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report Receipt#502.exe

Overview

General Information

Sample Name:Receipt#502.exe
Analysis ID:323033
MD5:e2e26573196fd444c8845d29e73a6b00
SHA1:8a2fc9e82c11d234e74846451b12c73d69dea955
SHA256:40fe69be55041a8607bf2596d0fa649ab26f6d6bd6973fb955f14f4e8a066b6c
Tags:exeNanoCorenVpnRAT

Most interesting Screenshot:

Detection

Nanocore
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected Nanocore Rat
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AntiVM_3
Yara detected Nanocore RAT
.NET source code contains potential unpacker
Allocates memory in foreign processes
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Startup

  • System is w10x64
  • Receipt#502.exe (PID: 4636 cmdline: 'C:\Users\user\Desktop\Receipt#502.exe' MD5: E2E26573196FD444C8845D29E73A6B00)
    • schtasks.exe (PID: 1384 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NeKPJNb' /XML 'C:\Users\user\AppData\Local\Temp\tmpD3E9.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 1140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • RegSvcs.exe (PID: 5476 cmdline: {path} MD5: 71369277D09DA0830C8C59F9E22BB23A)
    • RegSvcs.exe (PID: 5480 cmdline: {path} MD5: 71369277D09DA0830C8C59F9E22BB23A)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000003.261720988.0000000004293000.00000004.00000001.sdmpNanoCoreunknown Kevin Breen <kevin@techanarchy.net>
  • 0x211a:$a: NanoCore
  • 0x213f:$a: NanoCore
  • 0x2198:$a: NanoCore
  • 0x12335:$a: NanoCore
  • 0x1235b:$a: NanoCore
  • 0x123b7:$a: NanoCore
  • 0x1f20c:$a: NanoCore
  • 0x1f265:$a: NanoCore
  • 0x1f298:$a: NanoCore
  • 0x1f4c4:$a: NanoCore
  • 0x1f540:$a: NanoCore
  • 0x1fb59:$a: NanoCore
  • 0x1fca2:$a: NanoCore
  • 0x20176:$a: NanoCore
  • 0x2045d:$a: NanoCore
  • 0x20474:$a: NanoCore
  • 0x237fd:$a: NanoCore
  • 0x24bb7:$a: NanoCore
  • 0x24c01:$a: NanoCore
  • 0x2585b:$a: NanoCore
  • 0x2ae40:$a: NanoCore
00000000.00000002.254057757.0000000003CD8000.00000004.00000001.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
  • 0x13056d:$x1: NanoCore.ClientPluginHost
  • 0x1305aa:$x2: IClientNetworkHost
  • 0x1340dd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.254057757.0000000003CD8000.00000004.00000001.sdmpJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
    00000000.00000002.254057757.0000000003CD8000.00000004.00000001.sdmpNanoCoreunknown Kevin Breen <kevin@techanarchy.net>
    • 0x1302d5:$a: NanoCore
    • 0x1302e5:$a: NanoCore
    • 0x130519:$a: NanoCore
    • 0x13052d:$a: NanoCore
    • 0x13056d:$a: NanoCore
    • 0x130334:$b: ClientPlugin
    • 0x130536:$b: ClientPlugin
    • 0x130576:$b: ClientPlugin
    • 0x13045b:$c: ProjectData
    • 0x130e62:$d: DESCrypto
    • 0x13882e:$e: KeepAlive
    • 0x13681c:$g: LogClientMessage
    • 0x132a17:$i: get_Connected
    • 0x131198:$j: #=q
    • 0x1311c8:$j: #=q
    • 0x1311e4:$j: #=q
    • 0x131214:$j: #=q
    • 0x131230:$j: #=q
    • 0x13124c:$j: #=q
    • 0x13127c:$j: #=q
    • 0x131298:$j: #=q
    00000000.00000002.254741913.0000000003EC2000.00000004.00000001.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
    • 0x1e881d:$x1: NanoCore.ClientPluginHost
    • 0x1e885a:$x2: IClientNetworkHost
    • 0x1ec38d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
    Click to see the 8 entries

    Sigma Overview

    System Summary:

    barindex
    Sigma detected: NanoCoreShow sources
    Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, ProcessId: 5480, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
    Sigma detected: Scheduled temp file as task from temp locationShow sources
    Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NeKPJNb' /XML 'C:\Users\user\AppData\Local\Temp\tmpD3E9.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NeKPJNb' /XML 'C:\Users\user\AppData\Local\Temp\tmpD3E9.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\Receipt#502.exe' , ParentImage: C:\Users\user\Desktop\Receipt#502.exe, ParentProcessId: 4636, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NeKPJNb' /XML 'C:\Users\user\AppData\Local\Temp\tmpD3E9.tmp', ProcessId: 1384

    Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Multi AV Scanner detection for dropped fileShow sources
    Source: C:\Users\user\AppData\Roaming\NeKPJNb.exeReversingLabs: Detection: 20%
    Multi AV Scanner detection for submitted fileShow sources
    Source: Receipt#502.exeReversingLabs: Detection: 20%
    Yara detected Nanocore RATShow sources
    Source: Yara matchFile source: 00000000.00000002.254057757.0000000003CD8000.00000004.00000001.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000000.00000002.254741913.0000000003EC2000.00000004.00000001.sdmp, type: MEMORY
    Source: Yara matchFile source: Process Memory Space: Receipt#502.exe PID: 4636, type: MEMORY
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 4x nop then jmp 0287C3FAh

    Networking:

    barindex
    Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
    Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49709 -> 185.244.30.221:2078
    Uses dynamic DNS servicesShow sources
    Source: unknownDNS query: name: without.duckdns.org
    Source: global trafficTCP traffic: 192.168.2.5:49709 -> 185.244.30.221:2078
    Source: Joe Sandbox ViewASN Name: DAVID_CRAIGGG DAVID_CRAIGGG
    Source: unknownDNS traffic detected: queries for: without.duckdns.org
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
    Source: RegSvcs.exe, 00000005.00000003.261720988.0000000004293000.00000004.00000001.sdmpString found in binary or memory: http://google.com
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
    Source: Receipt#502.exe, 00000000.00000003.238406656.0000000004F72000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
    Source: Receipt#502.exe, 00000000.00000003.238533764.0000000004F74000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coma-e
    Source: Receipt#502.exe, 00000000.00000003.238614597.0000000004F74000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comd
    Source: Receipt#502.exe, 00000000.00000003.238614597.0000000004F74000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comes
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
    Source: Receipt#502.exe, 00000000.00000003.238533764.0000000004F74000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comn-uGu
    Source: Receipt#502.exe, 00000000.00000003.238422196.0000000004F79000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comn-uh
    Source: Receipt#502.exe, 00000000.00000003.238273524.0000000004F86000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.como.
    Source: Receipt#502.exe, 00000000.00000003.238533764.0000000004F74000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coms
    Source: Receipt#502.exe, 00000000.00000003.238614597.0000000004F74000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comtrWv
    Source: Receipt#502.exe, 00000000.00000003.238533764.0000000004F74000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comu
    Source: Receipt#502.exe, 00000000.00000003.240885938.0000000004F72000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
    Source: Receipt#502.exe, 00000000.00000003.241659047.0000000004FA5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers$=
    Source: Receipt#502.exe, 00000000.00000003.240941777.0000000004FA5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers-
    Source: Receipt#502.exe, 00000000.00000003.240647661.0000000004FA5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
    Source: Receipt#502.exe, 00000000.00000003.240614990.0000000004FA5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersd
    Source: Receipt#502.exe, 00000000.00000003.241659047.0000000004FA5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersers
    Source: Receipt#502.exe, 00000000.00000003.241049835.0000000004FA5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersf=
    Source: Receipt#502.exe, 00000000.00000003.241857098.0000000004FA5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersn
    Source: Receipt#502.exe, 00000000.00000003.241857098.0000000004FA5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersx=
    Source: Receipt#502.exe, 00000000.00000003.241721705.0000000004F72000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comF
    Source: Receipt#502.exe, 00000000.00000003.251857385.0000000004F70000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.coma
    Source: Receipt#502.exe, 00000000.00000003.251857385.0000000004F70000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comasv
    Source: Receipt#502.exe, 00000000.00000003.241721705.0000000004F72000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comd
    Source: Receipt#502.exe, 00000000.00000003.241721705.0000000004F72000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comessed
    Source: Receipt#502.exe, 00000000.00000003.240885938.0000000004F72000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comldF
    Source: Receipt#502.exe, 00000000.00000003.251857385.0000000004F70000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comm
    Source: Receipt#502.exe, 00000000.00000003.241721705.0000000004F72000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comsiv
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
    Source: Receipt#502.exe, 00000000.00000003.237720086.0000000004F80000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnIT
    Source: Receipt#502.exe, 00000000.00000003.237743636.000000000114B000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnd
    Source: Receipt#502.exe, 00000000.00000003.237720086.0000000004F80000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cntteI
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
    Source: Receipt#502.exe, 00000000.00000003.239054630.0000000004F75000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
    Source: Receipt#502.exe, 00000000.00000003.239418396.0000000004F7C000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/?
    Source: Receipt#502.exe, 00000000.00000003.239054630.0000000004F75000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/H
    Source: Receipt#502.exe, 00000000.00000003.239418396.0000000004F7C000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/S
    Source: Receipt#502.exe, 00000000.00000003.239418396.0000000004F7C000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
    Source: Receipt#502.exe, 00000000.00000003.239054630.0000000004F75000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Z
    Source: Receipt#502.exe, 00000000.00000003.239418396.0000000004F7C000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/h
    Source: Receipt#502.exe, 00000000.00000003.239054630.0000000004F75000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
    Source: Receipt#502.exe, 00000000.00000003.239418396.0000000004F7C000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/O
    Source: Receipt#502.exe, 00000000.00000003.239418396.0000000004F7C000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/Z
    Source: Receipt#502.exe, 00000000.00000003.239054630.0000000004F75000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/r
    Source: Receipt#502.exe, 00000000.00000003.239054630.0000000004F75000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/w
    Source: Receipt#502.exe, 00000000.00000003.242763996.0000000004FA5000.00000004.00000001.sdmp, Receipt#502.exe, 00000000.00000003.242740004.0000000004FA5000.00000004.00000001.sdmpString found in binary or memory: http://www.monotype.
    Source: Receipt#502.exe, 00000000.00000003.243733741.0000000004FA9000.00000004.00000001.sdmpString found in binary or memory: http://www.monotype.m
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
    Source: Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
    Source: Receipt#502.exe, 00000000.00000003.238223808.0000000004F83000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cno.

    E-Banking Fraud:

    barindex
    Yara detected Nanocore RATShow sources
    Source: Yara matchFile source: 00000000.00000002.254057757.0000000003CD8000.00000004.00000001.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000000.00000002.254741913.0000000003EC2000.00000004.00000001.sdmp, type: MEMORY
    Source: Yara matchFile source: Process Memory Space: Receipt#502.exe PID: 4636, type: MEMORY

    System Summary:

    barindex
    Malicious sample detected (through community Yara rule)Show sources
    Source: 00000005.00000003.261720988.0000000004293000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 00000000.00000002.254057757.0000000003CD8000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
    Source: 00000000.00000002.254057757.0000000003CD8000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 00000000.00000002.254741913.0000000003EC2000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
    Source: 00000000.00000002.254741913.0000000003EC2000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: Process Memory Space: Receipt#502.exe PID: 4636, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
    Source: Process Memory Space: Receipt#502.exe PID: 4636, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: Process Memory Space: RegSvcs.exe PID: 5480, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_07F51C52 NtQuerySystemInformation,
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_07F51C18 NtQuerySystemInformation,
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_0287B69F
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_02872AEC
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_0287A03D
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_02871739
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_0287A4D9
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_0287A051
    Source: Receipt#502.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
    Source: NeKPJNb.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
    Source: Receipt#502.exeBinary or memory string: OriginalFilename vs Receipt#502.exe
    Source: Receipt#502.exe, 00000000.00000002.251961319.0000000000562000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameWd.exe2 vs Receipt#502.exe
    Source: Receipt#502.exe, 00000000.00000002.258409433.0000000007F20000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMARCUS.dll4 vs Receipt#502.exe
    Source: Receipt#502.exe, 00000000.00000002.254741913.0000000003EC2000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameB2B.exe4 vs Receipt#502.exe
    Source: Receipt#502.exe, 00000000.00000002.258056962.0000000006BF0000.00000002.00000001.sdmpBinary or memory string: originalfilename vs Receipt#502.exe
    Source: Receipt#502.exe, 00000000.00000002.258056962.0000000006BF0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs Receipt#502.exe
    Source: Receipt#502.exe, 00000000.00000002.258250701.0000000007EC0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Receipt#502.exe
    Source: Receipt#502.exe, 00000000.00000002.257944997.0000000006B90000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs Receipt#502.exe
    Source: Receipt#502.exeBinary or memory string: OriginalFilenameWd.exe2 vs Receipt#502.exe
    Source: 00000005.00000003.261720988.0000000004293000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 00000000.00000002.254057757.0000000003CD8000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
    Source: 00000000.00000002.254057757.0000000003CD8000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 00000000.00000002.254741913.0000000003EC2000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
    Source: 00000000.00000002.254741913.0000000003EC2000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: Process Memory Space: Receipt#502.exe PID: 4636, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
    Source: Process Memory Space: Receipt#502.exe PID: 4636, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: Process Memory Space: RegSvcs.exe PID: 5480, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: Receipt#502.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    Source: NeKPJNb.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    Source: classification engineClassification label: mal100.troj.evad.winEXE@8/8@2/2
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_07F51782 AdjustTokenPrivileges,
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_07F5174B AdjustTokenPrivileges,
    Source: C:\Users\user\Desktop\Receipt#502.exeFile created: C:\Users\user\AppData\Roaming\NeKPJNb.exeJump to behavior
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{17fd7e7e-3990-4c53-9987-94767303fd64}
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
    Source: C:\Users\user\Desktop\Receipt#502.exeMutant created: \Sessions\1\BaseNamedObjects\hiXqVUTdIiJejPpdAJEytXszilO
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1140:120:WilError_01
    Source: C:\Users\user\Desktop\Receipt#502.exeFile created: C:\Users\user\AppData\Local\Temp\tmpD3E9.tmpJump to behavior
    Source: Receipt#502.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\Receipt#502.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
    Source: C:\Users\user\Desktop\Receipt#502.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
    Source: C:\Users\user\Desktop\Receipt#502.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
    Source: C:\Users\user\Desktop\Receipt#502.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
    Source: C:\Users\user\Desktop\Receipt#502.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
    Source: Receipt#502.exeReversingLabs: Detection: 20%
    Source: C:\Users\user\Desktop\Receipt#502.exeFile read: C:\Users\user\Desktop\Receipt#502.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\Receipt#502.exe 'C:\Users\user\Desktop\Receipt#502.exe'
    Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NeKPJNb' /XML 'C:\Users\user\AppData\Local\Temp\tmpD3E9.tmp'
    Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: unknownProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe {path}
    Source: unknownProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe {path}
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NeKPJNb' /XML 'C:\Users\user\AppData\Local\Temp\tmpD3E9.tmp'
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe {path}
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe {path}
    Source: C:\Users\user\Desktop\Receipt#502.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
    Source: C:\Users\user\Desktop\Receipt#502.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
    Source: Receipt#502.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
    Source: C:\Users\user\Desktop\Receipt#502.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll
    Source: Receipt#502.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
    Source: Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: RegSvcs.exe, 00000005.00000003.261720988.0000000004293000.00000004.00000001.sdmp
    Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: RegSvcs.exe, 00000005.00000003.261720988.0000000004293000.00000004.00000001.sdmp
    Source: Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: RegSvcs.exe, 00000005.00000003.261720988.0000000004293000.00000004.00000001.sdmp
    Source: Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: RegSvcs.exe, 00000005.00000003.261720988.0000000004293000.00000004.00000001.sdmp
    Source: Binary string: mscorrc.pdb source: Receipt#502.exe, 00000000.00000002.258250701.0000000007EC0000.00000002.00000001.sdmp
    Source: Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: RegSvcs.exe, 00000005.00000003.261720988.0000000004293000.00000004.00000001.sdmp

    Data Obfuscation:

    barindex
    .NET source code contains potential unpackerShow sources
    Source: Receipt#502.exe, SimpleTextEditor/LoginForm.cs.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
    Source: NeKPJNb.exe.0.dr, SimpleTextEditor/LoginForm.cs.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
    Source: 0.0.Receipt#502.exe.560000.0.unpack, SimpleTextEditor/LoginForm.cs.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
    Source: 0.2.Receipt#502.exe.560000.0.unpack, SimpleTextEditor/LoginForm.cs.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_005689D0 push ss; iretd
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_00568119 push 00000000h; iretd
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_00DE2894 push cs; ret
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_00DE2E0D push es; ret
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_00DE29AC push cs; ret
    Source: C:\Users\user\Desktop\Receipt#502.exeCode function: 0_2_00DE2864 push cs; ret
    Source: initial sampleStatic PE information: section name: .text entropy: 7.75101312154
    Source: initial sampleStatic PE information: section name: .text entropy: 7.75101312154
    Source: C:\Users\user\Desktop\Receipt#502.exeFile created: C:\Users\user\AppData\Roaming\NeKPJNb.exeJump to dropped file

    Boot Survival:

    barindex
    Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
    Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NeKPJNb' /XML 'C:\Users\user\AppData\Local\Temp\tmpD3E9.tmp'

    Hooking and other Techniques for Hiding and Protection:

    barindex
    Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe:Zone.Identifier read attributes | delete
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX

    Malware Analysis System Evasion:

    barindex
    Yara detected AntiVM_3Show sources
    Source: Yara matchFile source: 00000000.00000002.253473397.0000000002D49000.00000004.00000001.sdmp, type: MEMORY
    Source: Yara matchFile source: Process Memory Space: Receipt#502.exe PID: 4636, type: MEMORY
    Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
    Source: Receipt#502.exe, 00000000.00000002.253382062.0000000002CD1000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLLX1(R
    Source: Receipt#502.exe, 00000000.00000002.253957388.000000000304A000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
    Source: Receipt#502.exe, 00000000.00000002.253957388.000000000304A000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
    Source: Receipt#502.exe, 00000000.00000002.253382062.0000000002CD1000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAMEX1(RF]
    Source: C:\Users\user\Desktop\Receipt#502.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
    Source: C:\Users\user\Desktop\Receipt#502.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWindow / User API: threadDelayed 814
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWindow / User API: foregroundWindowGot 707
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWindow / User API: foregroundWindowGot 698
    Source: C:\Users\user\Desktop\Receipt#502.exe TID: 4632Thread sleep time: -41500s >= -30000s
    Source: C:\Users\user\Desktop\Receipt#502.exe TID: 456Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: Receipt#502.exe, 00000000.00000002.253957388.000000000304A000.00000004.00000001.sdmpBinary or memory string: VMware
    Source: Receipt#502.exe, 00000000.00000002.253957388.000000000304A000.00000004.00000001.sdmpBinary or memory string: VMware|9(r
    Source: Receipt#502.exe, 00000000.00000002.253382062.0000000002CD1000.00000004.00000001.sdmpBinary or memory string: VMWAREX1(rl[
    Source: Receipt#502.exe, 00000000.00000002.253382062.0000000002CD1000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIX1(r
    Source: Receipt#502.exe, 00000000.00000002.253382062.0000000002CD1000.00000004.00000001.sdmpBinary or memory string: vmwareX1(r
    Source: Receipt#502.exe, 00000000.00000002.253957388.000000000304A000.00000004.00000001.sdmpBinary or memory string: VMWARE
    Source: RegSvcs.exe, 00000005.00000003.304322811.0000000000F9F000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'
    Source: Receipt#502.exe, 00000000.00000002.253382062.0000000002CD1000.00000004.00000001.sdmpBinary or memory string: QEMUX1(r}]
    Source: Receipt#502.exe, 00000000.00000002.253957388.000000000304A000.00000004.00000001.sdmpBinary or memory string: VMWARE|9(r
    Source: Receipt#502.exe, 00000000.00000002.253382062.0000000002CD1000.00000004.00000001.sdmpBinary or memory string: (r#"SOFTWARE\VMware, Inc.\VMware ToolsX1(rI[
    Source: Receipt#502.exe, 00000000.00000002.253957388.000000000304A000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
    Source: Receipt#502.exe, 00000000.00000002.253957388.000000000304A000.00000004.00000001.sdmpBinary or memory string: VMware
    Source: Receipt#502.exe, 00000000.00000002.253957388.000000000304A000.00000004.00000001.sdmpBinary or memory string: VMware |9(r
    Source: Receipt#502.exe, 00000000.00000002.253957388.000000000304A000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
    Source: Receipt#502.exe, 00000000.00000002.253957388.000000000304A000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
    Source: Receipt#502.exe, 00000000.00000002.253382062.0000000002CD1000.00000004.00000001.sdmpBinary or memory string: (r&%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\X1(r
    Source: Receipt#502.exe, 00000000.00000002.253957388.000000000304A000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess information queried: ProcessInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess token adjusted: Debug
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess token adjusted: Debug
    Source: C:\Users\user\Desktop\Receipt#502.exeMemory allocated: page read and write | page guard

    HIPS / PFW / Operating System Protection Evasion:

    barindex
    Allocates memory in foreign processesShow sources
    Source: C:\Users\user\Desktop\Receipt#502.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 400000 protect: page execute and read and write
    Injects a PE file into a foreign processesShow sources
    Source: C:\Users\user\Desktop\Receipt#502.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 400000 value starts with: 4D5A
    Writes to foreign memory regionsShow sources
    Source: C:\Users\user\Desktop\Receipt#502.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 400000
    Source: C:\Users\user\Desktop\Receipt#502.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 402000
    Source: C:\Users\user\Desktop\Receipt#502.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 420000
    Source: C:\Users\user\Desktop\Receipt#502.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 422000
    Source: C:\Users\user\Desktop\Receipt#502.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: B00008
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NeKPJNb' /XML 'C:\Users\user\AppData\Local\Temp\tmpD3E9.tmp'
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe {path}
    Source: C:\Users\user\Desktop\Receipt#502.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe {path}
    Source: RegSvcs.exe, 00000005.00000003.304322811.0000000000F9F000.00000004.00000001.sdmpBinary or memory string: Program Manager.NET\Framework\v2.0.50727\
    Source: RegSvcs.exe, 00000005.00000003.354584389.0000000000F8A000.00000004.00000001.sdmpBinary or memory string: Program Manager
    Source: RegSvcs.exe, 00000005.00000003.354143378.0000000000F9F000.00000004.00000001.sdmpBinary or memory string: Program ManagerCC
    Source: RegSvcs.exe, 00000005.00000003.304322811.0000000000F9F000.00000004.00000001.sdmpBinary or memory string: Program ManagerX
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
    Source: C:\Users\user\Desktop\Receipt#502.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
    Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

    Stealing of Sensitive Information:

    barindex
    Yara detected Nanocore RATShow sources
    Source: Yara matchFile source: 00000000.00000002.254057757.0000000003CD8000.00000004.00000001.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000000.00000002.254741913.0000000003EC2000.00000004.00000001.sdmp, type: MEMORY
    Source: Yara matchFile source: Process Memory Space: Receipt#502.exe PID: 4636, type: MEMORY

    Remote Access Functionality:

    barindex
    Detected Nanocore RatShow sources
    Source: Receipt#502.exe, 00000000.00000002.254741913.0000000003EC2000.00000004.00000001.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: RegSvcs.exe, 00000005.00000003.261720988.0000000004293000.00000004.00000001.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: RegSvcs.exe, 00000005.00000003.261720988.0000000004293000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
    Source: RegSvcs.exe, 00000005.00000003.261720988.0000000004293000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
    Source: RegSvcs.exe, 00000005.00000003.261720988.0000000004293000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
    Source: RegSvcs.exe, 00000005.00000003.261720988.0000000004293000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
    Yara detected Nanocore RATShow sources
    Source: Yara matchFile source: 00000000.00000002.254057757.0000000003CD8000.00000004.00000001.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000000.00000002.254741913.0000000003EC2000.00000004.00000001.sdmp, type: MEMORY
    Source: Yara matchFile source: Process Memory Space: Receipt#502.exe PID: 4636, type: MEMORY

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management Instrumentation1Scheduled Task/Job1Access Token Manipulation1Masquerading1OS Credential DumpingSecurity Software Discovery221Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/Job1Boot or Logon Initialization ScriptsProcess Injection312Virtualization/Sandbox Evasion3LSASS MemoryVirtualization/Sandbox Evasion3Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Scheduled Task/Job1Disable or Modify Tools1Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationRemote Access Software1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Access Token Manipulation1NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferNon-Application Layer Protocol1SIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptProcess Injection312LSA SecretsFile and Directory Discovery1SSHKeyloggingData Transfer Size LimitsApplication Layer Protocol11Manipulate Device CommunicationManipulate App Store Rankings or Ratings
    Replication Through Removable MediaLaunchdRc.commonRc.commonHidden Files and Directories1Cached Domain CredentialsSystem Information Discovery12VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
    External Remote ServicesScheduled TaskStartup ItemsStartup ItemsObfuscated Files or Information3DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
    Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobSoftware Packing12Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    Receipt#502.exe21%ReversingLabsByteCode-MSIL.Trojan.Ursu

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Users\user\AppData\Roaming\NeKPJNb.exe21%ReversingLabsByteCode-MSIL.Trojan.Ursu

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    http://www.founder.com.cn/cnIT0%Avira URL Cloudsafe
    http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
    http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
    http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
    http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
    http://www.carterandcone.comes0%Avira URL Cloudsafe
    http://www.fontbureau.comsiv0%Avira URL Cloudsafe
    http://www.carterandcone.comn-uGu0%Avira URL Cloudsafe
    http://www.tiro.com0%URL Reputationsafe
    http://www.tiro.com0%URL Reputationsafe
    http://www.tiro.com0%URL Reputationsafe
    http://www.fontbureau.comessed0%URL Reputationsafe
    http://www.fontbureau.comessed0%URL Reputationsafe
    http://www.fontbureau.comessed0%URL Reputationsafe
    http://www.goodfont.co.kr0%URL Reputationsafe
    http://www.goodfont.co.kr0%URL Reputationsafe
    http://www.goodfont.co.kr0%URL Reputationsafe
    http://www.carterandcone.com0%URL Reputationsafe
    http://www.carterandcone.com0%URL Reputationsafe
    http://www.carterandcone.com0%URL Reputationsafe
    http://www.fontbureau.comldF0%Avira URL Cloudsafe
    http://www.sajatypeworks.com0%URL Reputationsafe
    http://www.sajatypeworks.com0%URL Reputationsafe
    http://www.sajatypeworks.com0%URL Reputationsafe
    http://www.typography.netD0%URL Reputationsafe
    http://www.typography.netD0%URL Reputationsafe
    http://www.typography.netD0%URL Reputationsafe
    http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
    http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
    http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
    http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
    http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
    http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
    http://fontfabrik.com0%URL Reputationsafe
    http://fontfabrik.com0%URL Reputationsafe
    http://fontfabrik.com0%URL Reputationsafe
    http://www.fontbureau.comasv0%Avira URL Cloudsafe
    http://www.monotype.m0%Avira URL Cloudsafe
    http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
    http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
    http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/jp/O0%Avira URL Cloudsafe
    http://www.sandoll.co.kr0%URL Reputationsafe
    http://www.sandoll.co.kr0%URL Reputationsafe
    http://www.sandoll.co.kr0%URL Reputationsafe
    http://www.urwpp.deDPlease0%URL Reputationsafe
    http://www.urwpp.deDPlease0%URL Reputationsafe
    http://www.urwpp.deDPlease0%URL Reputationsafe
    http://www.carterandcone.comn-uh0%Avira URL Cloudsafe
    http://www.zhongyicts.com.cn0%URL Reputationsafe
    http://www.zhongyicts.com.cn0%URL Reputationsafe
    http://www.zhongyicts.com.cn0%URL Reputationsafe
    http://www.carterandcone.como.0%URL Reputationsafe
    http://www.carterandcone.como.0%URL Reputationsafe
    http://www.carterandcone.como.0%URL Reputationsafe
    http://www.sakkal.com0%URL Reputationsafe
    http://www.sakkal.com0%URL Reputationsafe
    http://www.sakkal.com0%URL Reputationsafe
    http://www.founder.com.cn/cntteI0%Avira URL Cloudsafe
    http://www.jiyu-kobo.co.jp/jp/Z0%Avira URL Cloudsafe
    http://www.founder.com.cn/cnd0%URL Reputationsafe
    http://www.founder.com.cn/cnd0%URL Reputationsafe
    http://www.founder.com.cn/cnd0%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/Z0%Avira URL Cloudsafe
    http://www.fontbureau.comF0%URL Reputationsafe
    http://www.fontbureau.comF0%URL Reputationsafe
    http://www.fontbureau.comF0%URL Reputationsafe
    http://www.carterandcone.comd0%URL Reputationsafe
    http://www.carterandcone.comd0%URL Reputationsafe
    http://www.carterandcone.comd0%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/S0%Avira URL Cloudsafe
    http://www.jiyu-kobo.co.jp/H0%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/H0%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/H0%URL Reputationsafe
    http://www.carterandcone.comu0%Avira URL Cloudsafe
    http://www.carterandcone.coms0%Avira URL Cloudsafe
    http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
    http://www.carterandcone.coma-e0%Avira URL Cloudsafe
    http://www.fontbureau.coma0%URL Reputationsafe
    http://www.fontbureau.coma0%URL Reputationsafe
    http://www.fontbureau.coma0%URL Reputationsafe
    http://www.fontbureau.comd0%URL Reputationsafe
    http://www.fontbureau.comd0%URL Reputationsafe
    http://www.fontbureau.comd0%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/?0%Avira URL Cloudsafe
    http://www.carterandcone.coml0%URL Reputationsafe
    http://www.carterandcone.coml0%URL Reputationsafe
    http://www.carterandcone.coml0%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/w0%Avira URL Cloudsafe
    http://www.founder.com.cn/cn0%URL Reputationsafe
    http://www.founder.com.cn/cn0%URL Reputationsafe
    http://www.founder.com.cn/cn0%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/r0%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/r0%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/r0%URL Reputationsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    without.duckdns.org
    		185.244.30.221
    		truetrue
      		unknown
      g.msn.com
      		unknown
      		unknownfalse
        		high

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://www.fontbureau.com/designersGReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
          		high
          http://www.founder.com.cn/cnITReceipt#502.exe, 00000000.00000003.237720086.0000000004F80000.00000004.00000001.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://www.fontbureau.com/designers/?Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
            		high
            http://www.founder.com.cn/cn/bTheReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
            • URL Reputation: safe
            • URL Reputation: safe
            • URL Reputation: safe
            • URL Reputation: safe
            		unknown
            http://www.carterandcone.comesReceipt#502.exe, 00000000.00000003.238614597.0000000004F74000.00000004.00000001.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.fontbureau.com/designers?Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
              		high
              http://www.fontbureau.comsivReceipt#502.exe, 00000000.00000003.241721705.0000000004F72000.00000004.00000001.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.carterandcone.comn-uGuReceipt#502.exe, 00000000.00000003.238533764.0000000004F74000.00000004.00000001.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.tiro.comReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://www.fontbureau.com/designersReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                		high
                http://www.fontbureau.comessedReceipt#502.exe, 00000000.00000003.241721705.0000000004F72000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.goodfont.co.krReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.carterandcone.comReceipt#502.exe, 00000000.00000003.238406656.0000000004F72000.00000004.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.fontbureau.comldFReceipt#502.exe, 00000000.00000003.240885938.0000000004F72000.00000004.00000001.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://www.sajatypeworks.comReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.typography.netDReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.founder.com.cn/cn/cTheReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.galapagosdesign.com/staff/dennis.htmReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://fontfabrik.comReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.fontbureau.com/designersersReceipt#502.exe, 00000000.00000003.241659047.0000000004FA5000.00000004.00000001.sdmpfalse
                  		high
                  http://www.fontbureau.com/designersx=Receipt#502.exe, 00000000.00000003.241857098.0000000004FA5000.00000004.00000001.sdmpfalse
                    		high
                    http://www.fontbureau.comasvReceipt#502.exe, 00000000.00000003.251857385.0000000004F70000.00000004.00000001.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.monotype.mReceipt#502.exe, 00000000.00000003.243733741.0000000004FA9000.00000004.00000001.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.fontbureau.com/designersdReceipt#502.exe, 00000000.00000003.240614990.0000000004FA5000.00000004.00000001.sdmpfalse
                      		high
                      http://www.galapagosdesign.com/DPleaseReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.jiyu-kobo.co.jp/Y0Receipt#502.exe, 00000000.00000003.239418396.0000000004F7C000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.jiyu-kobo.co.jp/jp/OReceipt#502.exe, 00000000.00000003.239418396.0000000004F7C000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.fonts.comReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                        		high
                        http://www.sandoll.co.krReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.urwpp.deDPleaseReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.carterandcone.comn-uhReceipt#502.exe, 00000000.00000003.238422196.0000000004F79000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.zhongyicts.com.cnReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.carterandcone.como.Receipt#502.exe, 00000000.00000003.238273524.0000000004F86000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.sakkal.comReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designersnReceipt#502.exe, 00000000.00000003.241857098.0000000004FA5000.00000004.00000001.sdmpfalse
                          		high
                          http://www.founder.com.cn/cntteIReceipt#502.exe, 00000000.00000003.237720086.0000000004F80000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.jiyu-kobo.co.jp/jp/ZReceipt#502.exe, 00000000.00000003.239418396.0000000004F7C000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.founder.com.cn/cndReceipt#502.exe, 00000000.00000003.237743636.000000000114B000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.jiyu-kobo.co.jp/ZReceipt#502.exe, 00000000.00000003.239054630.0000000004F75000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.apache.org/licenses/LICENSE-2.0Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                            		high
                            http://www.fontbureau.comReceipt#502.exe, 00000000.00000003.240885938.0000000004F72000.00000004.00000001.sdmpfalse
                              		high
                              http://www.fontbureau.comFReceipt#502.exe, 00000000.00000003.241721705.0000000004F72000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.carterandcone.comdReceipt#502.exe, 00000000.00000003.238614597.0000000004F74000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/SReceipt#502.exe, 00000000.00000003.239418396.0000000004F7C000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/HReceipt#502.exe, 00000000.00000003.239054630.0000000004F75000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.carterandcone.comuReceipt#502.exe, 00000000.00000003.238533764.0000000004F74000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.carterandcone.comsReceipt#502.exe, 00000000.00000003.238533764.0000000004F74000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/jp/Receipt#502.exe, 00000000.00000003.239054630.0000000004F75000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.carterandcone.coma-eReceipt#502.exe, 00000000.00000003.238533764.0000000004F74000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.fontbureau.comaReceipt#502.exe, 00000000.00000003.251857385.0000000004F70000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.comdReceipt#502.exe, 00000000.00000003.241721705.0000000004F72000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/?Receipt#502.exe, 00000000.00000003.239418396.0000000004F7C000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.carterandcone.comlReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.com/designers/cabarga.htmlNReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                                		high
                                http://www.jiyu-kobo.co.jp/wReceipt#502.exe, 00000000.00000003.239054630.0000000004F75000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.founder.com.cn/cnReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designers-Receipt#502.exe, 00000000.00000003.240941777.0000000004FA5000.00000004.00000001.sdmpfalse
                                  		high
                                  http://www.fontbureau.com/designers/frere-jones.htmlReceipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                                    		high
                                    http://www.jiyu-kobo.co.jp/rReceipt#502.exe, 00000000.00000003.239054630.0000000004F75000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.monotype.Receipt#502.exe, 00000000.00000003.242763996.0000000004FA5000.00000004.00000001.sdmp, Receipt#502.exe, 00000000.00000003.242740004.0000000004FA5000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.commReceipt#502.exe, 00000000.00000003.251857385.0000000004F70000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.jiyu-kobo.co.jp/Receipt#502.exe, 00000000.00000003.239054630.0000000004F75000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.zhongyicts.com.cno.Receipt#502.exe, 00000000.00000003.238223808.0000000004F83000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.com/designers8Receipt#502.exe, 00000000.00000002.256398475.0000000005120000.00000002.00000001.sdmpfalse
                                      		high
                                      http://www.jiyu-kobo.co.jp/hReceipt#502.exe, 00000000.00000003.239418396.0000000004F7C000.00000004.00000001.sdmpfalse
                                        		unknown
                                        http://www.carterandcone.comtrWvReceipt#502.exe, 00000000.00000003.238614597.0000000004F74000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.fontbureau.com/designers/Receipt#502.exe, 00000000.00000003.240647661.0000000004FA5000.00000004.00000001.sdmpfalse
                                          		high
                                          http://www.fontbureau.com/designers$=Receipt#502.exe, 00000000.00000003.241659047.0000000004FA5000.00000004.00000001.sdmpfalse
                                            		high
                                            http://www.fontbureau.com/designersf=Receipt#502.exe, 00000000.00000003.241049835.0000000004FA5000.00000004.00000001.sdmpfalse
                                              		high

                                              Contacted IPs

                                              • No. of IPs < 25%
                                              • 25% < No. of IPs < 50%
                                              • 50% < No. of IPs < 75%
                                              • 75% < No. of IPs

                                              Public

                                              IPDomainCountryFlagASNASN NameMalicious
                                              185.244.30.221
                                              		unknownNetherlands
                                              		209623DAVID_CRAIGGGtrue

                                              Private

                                              IP
                                              192.168.2.1

                                              General Information

                                              Joe Sandbox Version:31.0.0 Red Diamond
                                              Analysis ID:323033
                                              Start date:26.11.2020
                                              Start time:08:33:26
                                              Joe Sandbox Product:CloudBasic
                                              Overall analysis duration:0h 6m 40s
                                              Hypervisor based Inspection enabled:false
                                              Report type:light
                                              Sample file name:Receipt#502.exe
                                              Cookbook file name:default.jbs
                                              Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                              Number of analysed new started processes analysed:24
                                              Number of new started drivers analysed:0
                                              Number of existing processes analysed:0
                                              Number of existing drivers analysed:0
                                              Number of injected processes analysed:0
                                              Technologies:
                                              • HCA enabled
                                              • EGA enabled
                                              • HDC enabled
                                              • AMSI enabled
                                              Analysis Mode:default
                                              Analysis stop reason:Timeout
                                              Detection:MAL
                                              Classification:mal100.troj.evad.winEXE@8/8@2/2
                                              EGA Information:Failed
                                              HDC Information:Failed
                                              HCA Information:
                                              • Successful, ratio: 97%
                                              • Number of executed functions: 0
                                              • Number of non-executed functions: 0
                                              Cookbook Comments:
                                              • Adjust boot time
                                              • Enable AMSI
                                              • Found application associated with file extension: .exe
                                              Warnings:
                                              Show All
                                              • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                              • TCP Packets have been reduced to 100
                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                              • Excluded IPs from analysis (whitelisted): 92.122.144.200, 104.43.139.144, 51.11.168.160, 52.147.198.201, 20.54.26.129, 2.20.142.209, 2.20.142.210, 51.103.5.159, 104.43.193.48, 52.142.114.176, 92.122.213.247, 92.122.213.194
                                              • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wns.notify.windows.com.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, g-msn-com-nsatc.trafficmanager.net, par02p.wns.notify.windows.com.akadns.net, emea1.notify.windows.com.akadns.net, audownload.windowsupdate.nsatc.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, client.wns.windows.com, fs.microsoft.com, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, skypedataprdcolcus15.cloudapp.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net
                                              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                              • Report size getting too big, too many NtQueryValueKey calls found.

                                              Simulations

                                              Behavior and APIs

                                              TimeTypeDescription
                                              08:34:25API Interceptor2x Sleep call for process: Receipt#502.exe modified
                                              08:34:29API Interceptor1018x Sleep call for process: RegSvcs.exe modified

                                              Joe Sandbox View / Context

                                              IPs

                                              No context

                                              Domains

                                              No context

                                              ASN

                                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                              DAVID_CRAIGGGNew PO 64739 (UK).exeGet hashmaliciousBrowse
                                              • 185.140.53.207
                                              90987948.exeGet hashmaliciousBrowse
                                              • 185.244.30.223
                                              tzjEwwwbqK.exeGet hashmaliciousBrowse
                                              • 185.140.53.149
                                              PO456789.exeGet hashmaliciousBrowse
                                              • 185.244.30.212
                                              kelvinx.exeGet hashmaliciousBrowse
                                              • 185.140.53.132
                                              Order-2311.exeGet hashmaliciousBrowse
                                              • 91.193.75.147
                                              YZD221120.exeGet hashmaliciousBrowse
                                              • 91.193.75.147
                                              ORDER #201120A.exeGet hashmaliciousBrowse
                                              • 185.244.30.92
                                              oUI0jQS8xQ.exeGet hashmaliciousBrowse
                                              • 185.140.53.149
                                              Quotation ATB-PR28500KINH.exeGet hashmaliciousBrowse
                                              • 185.140.53.139
                                              Quotation ATB-PR28500KINH.exeGet hashmaliciousBrowse
                                              • 185.140.53.139
                                              Ups file de.exeGet hashmaliciousBrowse
                                              • 185.140.53.221
                                              NyUnwsFSCa.exeGet hashmaliciousBrowse
                                              • 185.140.53.149
                                              purchase order.exeGet hashmaliciousBrowse
                                              • 185.140.53.233
                                              Remittance Details.xlsGet hashmaliciousBrowse
                                              • 185.140.53.184
                                              PaymentConfirmation.exeGet hashmaliciousBrowse
                                              • 185.140.53.183
                                              ORDER #02676.doc.exeGet hashmaliciousBrowse
                                              • 185.244.30.92
                                              b11305c6ab207f830062f80eeec728c4.exeGet hashmaliciousBrowse
                                              • 185.140.53.233
                                              ShippingDoc.jarGet hashmaliciousBrowse
                                              • 185.244.30.139
                                              1kn1ejwPxi.exeGet hashmaliciousBrowse
                                              • 185.140.53.132

                                              JA3 Fingerprints

                                              No context

                                              Dropped Files

                                              No context

                                              Created / dropped Files

                                              C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Receipt#502.exe.log
                                              Process:C:\Users\user\Desktop\Receipt#502.exe
                                              File Type:ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):641
                                              Entropy (8bit):5.271473536084351
                                              Encrypted:false
                                              SSDEEP:12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk70U2u7x5I6Hi0Ug+9Yz9tv:MLF20NaL329hJ5g522rW2I3rOz2T
                                              MD5:C3EC08CD6BEA8576070D5A52B4B6D7D0
                                              SHA1:40B95253F98B3CC5953100C0E71DAC7915094A5A
                                              SHA-256:28B314C3E5651414FD36B2A65B644A2A55F007A34A536BE17514E12CEE5A091B
                                              SHA-512:5B0E6398A092F08240DC6765425E16DB52F32542FF7250E87403C407E54B3660EF93E0EAD17BA2CEF6B666951ACF66FA0EAD61FB52E80867DDD398E8258DED22
                                              Malicious:true
                                              Reputation:moderate, very likely benign file
                                              Preview: 1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\d05d469d89b319a068f2123e7e6f8621\System.Web.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..
                                              C:\Users\user\AppData\Local\Temp\tmpD3E9.tmp
                                              Process:C:\Users\user\Desktop\Receipt#502.exe
                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                              Category:dropped
                                              Size (bytes):1644
                                              Entropy (8bit):5.172014291604984
                                              Encrypted:false
                                              SSDEEP:24:2dH4+SEqC/a7hTlNMFpH/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBNETItn:cbhC7ZlNQF/rydbz9I3YODOLNdq3sS
                                              MD5:F033691D15512FA356BEDDA42A45D54B
                                              SHA1:5B87117DDF17EC4B3E69080974D503997D1603D3
                                              SHA-256:B80844A420C52AC3E1ADF3778CB3F173BBF7904D87273DA4C7DAEAE2130FF74E
                                              SHA-512:8EC8BA2E4675657A6494E51BED3A5E65848F7396BE907DE7DDD2D6C939A77C92890DDC2CB6A5862D3A446E7AC1D77A913660229C9F6E589A4764359097F463D7
                                              Malicious:true
                                              Reputation:low
                                              Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>t
                                              C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat
                                              Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):232
                                              Entropy (8bit):7.089541637477408
                                              Encrypted:false
                                              SSDEEP:3:XrURGizD7cnRNGbgCFKRNX/pBK0jCV83ne+VdWPiKgmR7kkmefoeLBizbCuVkqYM:X4LDAnybgCFcps0OafmCYDlizZr/i/Oh
                                              MD5:9E7D0351E4DF94A9B0BADCEB6A9DB963
                                              SHA1:76C6A69B1C31CEA2014D1FD1E222A3DD1E433005
                                              SHA-256:AAFC7B40C5FE680A2BB549C3B90AABAAC63163F74FFFC0B00277C6BBFF88B757
                                              SHA-512:93CCF7E046A3C403ECF8BC4F1A8850BA0180FE18926C98B297C5214EB77BC212C8FBCC58412D0307840CF2715B63BE68BACDA95AA98E82835C5C53F17EF38511
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview: Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+......*....~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&
                                              C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
                                              Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                              File Type:Non-ISO extended-ASCII text, with no line terminators
                                              Category:dropped
                                              Size (bytes):8
                                              Entropy (8bit):3.0
                                              Encrypted:false
                                              SSDEEP:3:am:am
                                              MD5:36331463881AC56549683D2481AC3E0C
                                              SHA1:35AD2749C9954148597145788A856ACE95B7A02E
                                              SHA-256:D7D3BDD45709C39129DD43B58A1DDC433AF3BA02A7F7771BB71803692E2440C2
                                              SHA-512:679A30939F5E3BE3404D283AC743A27DB5840C815787A7805346D56203E542AD1BB32D2C0027B766D4069647B461EB8323CBA207490823CFBA013A375EA9C0DA
                                              Malicious:true
                                              Reputation:low
                                              Preview: ..v%)..H
                                              C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bak
                                              Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):24
                                              Entropy (8bit):4.501629167387823
                                              Encrypted:false
                                              SSDEEP:3:9bzY6oRDIvYk:RzWDI3
                                              MD5:ACD3FB4310417DC77FE06F15B0E353E6
                                              SHA1:80E7002E655EB5765FDEB21114295CB96AD9D5EB
                                              SHA-256:DC3AE604991C9BB8FF8BC4502AE3D0DB8A3317512C0F432490B103B89C1A4368
                                              SHA-512:DA46A917DB6276CD4528CFE4AD113292D873CA2EBE53414730F442B83502E5FAF3D1AE87BFA295ADF01E3B44FDBCE239E21A318BFB2CCD1F4753846CB21F6F97
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview: 9iH...}Z.4..f..J".C;"a
                                              C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bin
                                              Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):64
                                              Entropy (8bit):5.320159765557392
                                              Encrypted:false
                                              SSDEEP:3:9bzY6oRDIvYVsRLY6oRDT6P2bfVn1:RzWDIfRWDT621
                                              MD5:BB0F9B9992809E733EFFF8B0E562CFD6
                                              SHA1:F0BAB3CF73A04F5A689E6AFC764FEE9276992742
                                              SHA-256:C48F04FE7525AA3A3F9540889883F649726233DE021724823720A59B4F37CEAC
                                              SHA-512:AE4280AA460DC1C0301D458A3A443F6884A0BE37481737B2ADAFD72C33C55F09BED88ED239C91FE6F19CA137AC3CD7C9B8454C21D3F8E759687F701C8B3C7A16
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview: 9iH...}Z.4..f..J".C;"a9iH...}Z.4..f.~a........~.~.......3.U.
                                              C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\storage.dat
                                              Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):426832
                                              Entropy (8bit):7.999527918131335
                                              Encrypted:true
                                              SSDEEP:6144:zKfHbamD8WN+JQYrjM7Ei2CsFJjyh9zvgPonV5HqZcPVT4Eb+Z6no3QSzjeMsdF/:zKf137EiDsTjevgArYcPVLoTQS+0iv
                                              MD5:653DDDCB6C89F6EC51F3DDC0053C5914
                                              SHA1:4CF7E7D42495CE01C261E4C5C4B8BF6CD76CCEE5
                                              SHA-256:83B9CAE66800C768887FB270728F6806CBEBDEAD9946FA730F01723847F17FF9
                                              SHA-512:27A467F2364C21CD1C6C34EF1CA5FFB09B4C3180FC9C025E293374EB807E4382108617BB4B97F8EBBC27581CD6E5988BB5E21276B3CB829C1C0E49A6FC9463A0
                                              Malicious:false
                                              Preview: ..g&jo...IPg...GM....R>i...o...I.>.&.r{....8...}...E....v.!7.u3e.. .....db...}.......".t(.xC9.cp.B....7...'.......%......w.^.._.......B.W%.<..i.0.{9.xS...5...)..w..$..C..?`F..u.5.T.X.w'Si..z.n{...Y!m...RA...xg....[7...z..9@.K.-...T..+.ACe....R....enO.....AoNMT.\^....}H&..4I...B.:..@..J...v..rI5..kP......2j....B..B.~.T..>.c..emW;Rn<9..[.r.o....R[....@=...:...L.g<.....I..%4[.G^.~.l'......v.p&.........+..S...9d/.{..H.`@.1..........f.\s...X.a.].<.h*...J4*...k.x....%3.......3.c..?%....>.!.}..)(.{...H...3..`'].Q.[sN..JX(.%pH....+......(...v.....H...3..8.a_..J..?4...y.N(..D.*h..g.jD..I...44Q?..N......oX.A......l...n?./..........$.!..;.^9"H........*...OkF....v.m_.e.v..f...."..bq{.....O.-....%R+...-..P.i..t5....2Z# ...#...,L..{..j..heT -=Z.P;...g.m)<owJ].J..../.p..8.u8.&..#.m9...j%..g&....g.x.I,....u.[....>./W...........*X...b*Z...ex.0..x.}.....Tb...[..H_M._.^N.d&...g._."@4N.pDs].GbT.......&p........Nw...%$=.....{..J.1....2....<E{..<!G..
                                              C:\Users\user\AppData\Roaming\NeKPJNb.exe
                                              Process:C:\Users\user\Desktop\Receipt#502.exe
                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Category:dropped
                                              Size (bytes):696832
                                              Entropy (8bit):7.224549357162399
                                              Encrypted:false
                                              SSDEEP:12288:lb4JO3lL2iNNOhnc4PrvIpMdd2lBKiIQulBt8LFSERr:lb4JO3lL1XWHv9dd2lEiIQ0P88E
                                              MD5:E2E26573196FD444C8845D29E73A6B00
                                              SHA1:8A2FC9E82C11D234E74846451B12C73D69DEA955
                                              SHA-256:40FE69BE55041A8607BF2596D0FA649AB26F6D6BD6973FB955F14F4E8A066B6C
                                              SHA-512:02906FAFFE3BB49E0A936F5D07215FFE8B7CC28B2F65536E17B1B6204AA7966998B4A70BB09BF5A1FDFAA6EFEF6F729FBEABB1A2E3C540CD1965F73EDABC8B78
                                              Malicious:true
                                              Antivirus:
                                              • Antivirus: ReversingLabs, Detection: 21%
                                              Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......_..............0.................. ... ....@.. ....................................@.....................................O.... ..<............................................................................ ............... ..H............text... .... ...................... ..`.rsrc...<.... ......................@..@.reloc..............................@..B........................H........r...c......x........F...........................................0..G.........}.....(.......(......s....}.....{.....o.....(......{.....{....o.....*..0...........(.....{....{....(.......(....~....vl....,..{....{....o......{....{.....o....o......{....(....}.....o......3..{....{....o.......+....,@..{....{....o....s......{.....{....{....o......{....{....o......*...{....(....o .....{....~....o!....*...{....("...o .....{....~....o!....*...0..+.........,..{.......+....,...{.

                                              Static File Info

                                              General

                                              File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                              Entropy (8bit):7.224549357162399
                                              TrID:
                                              • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                              • Win32 Executable (generic) a (10002005/4) 49.78%
                                              • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                              • Generic Win/DOS Executable (2004/3) 0.01%
                                              • DOS Executable Generic (2002/1) 0.01%
                                              File name:Receipt#502.exe
                                              File size:696832
                                              MD5:e2e26573196fd444c8845d29e73a6b00
                                              SHA1:8a2fc9e82c11d234e74846451b12c73d69dea955
                                              SHA256:40fe69be55041a8607bf2596d0fa649ab26f6d6bd6973fb955f14f4e8a066b6c
                                              SHA512:02906faffe3bb49e0a936f5d07215ffe8b7cc28b2f65536e17b1b6204aa7966998b4a70bb09bf5a1fdfaa6efef6f729fbeabb1a2e3c540cd1965f73edabc8b78
                                              SSDEEP:12288:lb4JO3lL2iNNOhnc4PrvIpMdd2lBKiIQulBt8LFSERr:lb4JO3lL1XWHv9dd2lEiIQ0P88E
                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......_..............0.................. ... ....@.. ....................................@................................

                                              File Icon

                                              Icon Hash:68f0e46cecf4e1e3

                                              Static PE Info

                                              General

                                              Entrypoint:0x481c1a
                                              Entrypoint Section:.text
                                              Digitally signed:false
                                              Imagebase:0x400000
                                              Subsystem:windows gui
                                              Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                              DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                              Time Stamp:0x5FBEF892 [Thu Nov 26 00:36:34 2020 UTC]
                                              TLS Callbacks:
                                              CLR (.Net) Version:v2.0.50727
                                              OS Version Major:4
                                              OS Version Minor:0
                                              File Version Major:4
                                              File Version Minor:0
                                              Subsystem Version Major:4
                                              Subsystem Version Minor:0
                                              Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                              Entrypoint Preview

                                              Instruction
                                              jmp dword ptr [00402000h]
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al
                                              add byte ptr [eax], al

                                              Data Directories

                                              NameVirtual AddressVirtual Size Is in Section
                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x81bc80x4f.text
                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x820000x29f3c.rsrc
                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0xac0000xc.reloc
                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                              Sections

                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                              .text0x20000x7fc200x7fe00False0.842004979228data7.75101312154IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                              .rsrc0x820000x29f3c0x2a000False0.128830682664data4.0760655749IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                              .reloc0xac0000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                              Resources

                                              NameRVASizeTypeLanguageCountry
                                              RT_ICON0x822b00x1f33PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                              RT_ICON0x841e40x10828dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
                                              RT_ICON0x94a0c0x94a8data
                                              RT_ICON0x9deb40x5488data
                                              RT_ICON0xa333c0x4228dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 47359, next used block 4282318848
                                              RT_ICON0xa75640x25a8data
                                              RT_ICON0xa9b0c0x10a8data
                                              RT_ICON0xaabb40x988data
                                              RT_ICON0xab53c0x468GLS_BINARY_LSB_FIRST
                                              RT_GROUP_ICON0xab9a40x84data
                                              RT_VERSION0xaba280x328data
                                              RT_MANIFEST0xabd500x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                              Imports

                                              DLLImport
                                              mscoree.dll_CorExeMain

                                              Version Infos

                                              DescriptionData
                                              Translation0x0000 0x04b0
                                              LegalCopyrightCopyright 2016 - 2020
                                              Assembly Version1.0.0.0
                                              InternalNameWd.exe
                                              FileVersion1.0.0.0
                                              CompanyNameVendetta Inc.
                                              LegalTrademarks
                                              Comments
                                              ProductNameAku Form
                                              ProductVersion1.0.0.0
                                              FileDescriptionAku Form
                                              OriginalFilenameWd.exe

                                              Network Behavior

                                              Snort IDS Alerts

                                              TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                              11/26/20-08:34:31.641727TCP2025019ET TROJAN Possible NanoCore C2 60B497092078192.168.2.5185.244.30.221

                                              Network Port Distribution

                                              TCP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Nov 26, 2020 08:34:31.474524975 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:31.582503080 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:31.583118916 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:31.641726971 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:31.797629118 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:31.797771931 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:31.826636076 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:31.868154049 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:31.966736078 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:31.966922998 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.075277090 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.099747896 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.362883091 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.363248110 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.363298893 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.363347054 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.363384008 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.363431931 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.363519907 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.477133989 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.477185965 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.477261066 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.477319956 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.485071898 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.485132933 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.485179901 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.485254049 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.485286951 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.486920118 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.491051912 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.491157055 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.585505009 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.585623026 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.585702896 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.585853100 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.585900068 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.586067915 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.595840931 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.595899105 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.596014023 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.596139908 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.596177101 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.596225977 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.596241951 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.596275091 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.596330881 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.596467018 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.596515894 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.596566916 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.607662916 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.607717037 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.607781887 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.608422995 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.608700991 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.608805895 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.698178053 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.698373079 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.698409081 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.698502064 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.701559067 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.701848030 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.701894045 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.701953888 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.701992035 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.702028990 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.702042103 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.702084064 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.702620029 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.702658892 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.702713966 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.702797890 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.702914953 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.702986002 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.702991009 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.703022957 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.703108072 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.703111887 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.703165054 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.703200102 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.703236103 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.703238010 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.703274965 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.703295946 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.703497887 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.703538895 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.703571081 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.703905106 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.703967094 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.704054117 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.704082966 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.704195976 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.720489025 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.720604897 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.720650911 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.720725060 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.720916033 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.721002102 CET497092078192.168.2.5185.244.30.221
                                              Nov 26, 2020 08:34:32.725481033 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.725653887 CET207849709185.244.30.221192.168.2.5
                                              Nov 26, 2020 08:34:32.725687981 CET207849709185.244.30.221192.168.2.5

                                              UDP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Nov 26, 2020 08:34:31.242402077 CET6217653192.168.2.58.8.8.8
                                              Nov 26, 2020 08:34:31.444324017 CET53621768.8.8.8192.168.2.5
                                              Nov 26, 2020 08:34:35.602926970 CET5959653192.168.2.58.8.8.8
                                              Nov 26, 2020 08:34:35.640588045 CET53595968.8.8.8192.168.2.5
                                              Nov 26, 2020 08:34:37.237322092 CET6529653192.168.2.58.8.8.8
                                              Nov 26, 2020 08:34:37.264524937 CET53652968.8.8.8192.168.2.5
                                              Nov 26, 2020 08:34:39.862066984 CET6318353192.168.2.58.8.8.8
                                              Nov 26, 2020 08:34:39.889306068 CET53631838.8.8.8192.168.2.5
                                              Nov 26, 2020 08:34:51.537843943 CET6015153192.168.2.58.8.8.8
                                              Nov 26, 2020 08:34:51.564810991 CET53601518.8.8.8192.168.2.5
                                              Nov 26, 2020 08:34:52.348002911 CET5696953192.168.2.58.8.8.8
                                              Nov 26, 2020 08:34:52.374954939 CET53569698.8.8.8192.168.2.5
                                              Nov 26, 2020 08:34:54.386253119 CET5516153192.168.2.58.8.8.8
                                              Nov 26, 2020 08:34:54.413346052 CET53551618.8.8.8192.168.2.5
                                              Nov 26, 2020 08:34:55.135413885 CET5475753192.168.2.58.8.8.8
                                              Nov 26, 2020 08:34:55.162417889 CET53547578.8.8.8192.168.2.5
                                              Nov 26, 2020 08:34:57.774050951 CET4999253192.168.2.58.8.8.8
                                              Nov 26, 2020 08:34:57.809693098 CET53499928.8.8.8192.168.2.5
                                              Nov 26, 2020 08:34:59.455619097 CET6007553192.168.2.58.8.8.8
                                              Nov 26, 2020 08:34:59.482768059 CET53600758.8.8.8192.168.2.5
                                              Nov 26, 2020 08:35:03.161185980 CET5501653192.168.2.58.8.8.8
                                              Nov 26, 2020 08:35:03.188561916 CET53550168.8.8.8192.168.2.5
                                              Nov 26, 2020 08:35:05.595487118 CET6434553192.168.2.58.8.8.8
                                              Nov 26, 2020 08:35:05.630959988 CET53643458.8.8.8192.168.2.5
                                              Nov 26, 2020 08:35:06.143502951 CET5712853192.168.2.58.8.8.8
                                              Nov 26, 2020 08:35:06.179116964 CET53571288.8.8.8192.168.2.5
                                              Nov 26, 2020 08:35:09.619523048 CET5479153192.168.2.58.8.8.8
                                              Nov 26, 2020 08:35:09.655287981 CET53547918.8.8.8192.168.2.5
                                              Nov 26, 2020 08:35:10.323987961 CET5046353192.168.2.58.8.8.8
                                              Nov 26, 2020 08:35:10.351022005 CET53504638.8.8.8192.168.2.5
                                              Nov 26, 2020 08:35:10.471493959 CET5039453192.168.2.58.8.8.8
                                              Nov 26, 2020 08:35:10.498734951 CET53503948.8.8.8192.168.2.5
                                              Nov 26, 2020 08:35:13.485687017 CET5853053192.168.2.58.8.8.8
                                              Nov 26, 2020 08:35:13.536479950 CET53585308.8.8.8192.168.2.5
                                              Nov 26, 2020 08:35:15.625456095 CET5381353192.168.2.58.8.8.8
                                              Nov 26, 2020 08:35:15.660779953 CET53538138.8.8.8192.168.2.5
                                              Nov 26, 2020 08:35:15.928908110 CET6373253192.168.2.58.8.8.8
                                              Nov 26, 2020 08:35:15.975043058 CET53637328.8.8.8192.168.2.5
                                              Nov 26, 2020 08:35:17.544102907 CET5734453192.168.2.58.8.8.8
                                              Nov 26, 2020 08:35:17.571263075 CET53573448.8.8.8192.168.2.5
                                              Nov 26, 2020 08:35:45.001585007 CET5445053192.168.2.58.8.8.8
                                              Nov 26, 2020 08:35:45.028789043 CET53544508.8.8.8192.168.2.5

                                              DNS Queries

                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                              Nov 26, 2020 08:34:31.242402077 CET192.168.2.58.8.8.80xd3a8Standard query (0)without.duckdns.orgA (IP address)IN (0x0001)
                                              Nov 26, 2020 08:35:13.485687017 CET192.168.2.58.8.8.80xd558Standard query (0)g.msn.comA (IP address)IN (0x0001)

                                              DNS Answers

                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                              Nov 26, 2020 08:34:31.444324017 CET8.8.8.8192.168.2.50xd3a8No error (0)without.duckdns.org185.244.30.221A (IP address)IN (0x0001)
                                              Nov 26, 2020 08:35:13.536479950 CET8.8.8.8192.168.2.50xd558No error (0)g.msn.comg-msn-com-nsatc.trafficmanager.netCNAME (Canonical name)IN (0x0001)

                                              Code Manipulations

                                              Statistics

                                              Behavior

                                              Click to jump to process

                                              System Behavior

                                              Analysis Process: Receipt#502.exe PID: 4636 Parent PID: 5656

                                              General

                                              Start time:08:34:20
                                              Start date:26/11/2020
                                              Path:C:\Users\user\Desktop\Receipt#502.exe
                                              Wow64 process (32bit):true
                                              Commandline:'C:\Users\user\Desktop\Receipt#502.exe'
                                              Imagebase:0x560000
                                              File size:696832 bytes
                                              MD5 hash:E2E26573196FD444C8845D29E73A6B00
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:.Net C# or VB.NET
                                              Yara matches:
                                              • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.254057757.0000000003CD8000.00000004.00000001.sdmp, Author: Florian Roth
                                              • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.254057757.0000000003CD8000.00000004.00000001.sdmp, Author: Joe Security
                                              • Rule: NanoCore, Description: unknown, Source: 00000000.00000002.254057757.0000000003CD8000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                              • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.254741913.0000000003EC2000.00000004.00000001.sdmp, Author: Florian Roth
                                              • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.254741913.0000000003EC2000.00000004.00000001.sdmp, Author: Joe Security
                                              • Rule: NanoCore, Description: unknown, Source: 00000000.00000002.254741913.0000000003EC2000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                              • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.253473397.0000000002D49000.00000004.00000001.sdmp, Author: Joe Security
                                              Reputation:low

                                              Analysis Process: schtasks.exe PID: 1384 Parent PID: 4636

                                              General

                                              Start time:08:34:26
                                              Start date:26/11/2020
                                              Path:C:\Windows\SysWOW64\schtasks.exe
                                              Wow64 process (32bit):true
                                              Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\NeKPJNb' /XML 'C:\Users\user\AppData\Local\Temp\tmpD3E9.tmp'
                                              Imagebase:0xa10000
                                              File size:185856 bytes
                                              MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:high

                                              Analysis Process: conhost.exe PID: 1140 Parent PID: 1384

                                              General

                                              Start time:08:34:27
                                              Start date:26/11/2020
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff7ecfc0000
                                              File size:625664 bytes
                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:high

                                              Analysis Process: RegSvcs.exe PID: 5476 Parent PID: 4636

                                              General

                                              Start time:08:34:27
                                              Start date:26/11/2020
                                              Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                              Wow64 process (32bit):false
                                              Commandline:{path}
                                              Imagebase:0x1e0000
                                              File size:32768 bytes
                                              MD5 hash:71369277D09DA0830C8C59F9E22BB23A
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:moderate

                                              Analysis Process: RegSvcs.exe PID: 5480 Parent PID: 4636

                                              General

                                              Start time:08:34:28
                                              Start date:26/11/2020
                                              Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                              Wow64 process (32bit):true
                                              Commandline:{path}
                                              Imagebase:0x7ff64e5e0000
                                              File size:32768 bytes
                                              MD5 hash:71369277D09DA0830C8C59F9E22BB23A
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:.Net C# or VB.NET
                                              Yara matches:
                                              • Rule: NanoCore, Description: unknown, Source: 00000005.00000003.261720988.0000000004293000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                              Reputation:moderate

                                              Disassembly

                                              Code Analysis

                                              Reset < >