Windows Analysis Report R6093846s-Invoice-Receipt.exe

Overview

General Information

Sample Name:	R6093846s-Invoice-Receipt.exe
Analysis ID:	452642
MD5:	cd0645cb78b55f0babbdbc4d51f23bd8
SHA1:	f5221832b2b4b7338bc21e42f7e2c983d82dbdf4
SHA256:	5b618273e08f4e9633ec359cff551345d0dabf0c64da9d3b5437d1c88c4bd226
Tags:	exeNanoCoreRAT
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Nanocore RAT

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Antivirus or Machine Learning detection for unpacked file

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Signatures

AV Detection:

Found malware configuration

Source: 00000014.00000002.479043770.0000000003891000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "f8dffc54-5ec5-4013-9de8-d8d85368", "Group": "CODEDBASE", "Domain1": "omaprilcode.duckdns.org", "Domain2": "omaprilcode.duckdns.org", "Port": 8090, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Multi AV Scanner detection for domain / URL

Source: omaprilcode.duckdns.org	Virustotal: Detection: 8%			Perma Link
Source: omaprilcode.duckdns.org	Virustotal: Detection: 8%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\UALCBPTejUQxQ.exe

ReversingLabs: Detection: 32%

Multi AV Scanner detection for submitted file

Source: R6093846s-Invoice-Receipt.exe

ReversingLabs: Detection: 32%

Yara detected Nanocore RAT

Source: Yara match	File source: 20.2.RegSvcs.exe.5b90000.20.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.448b680.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.38dff64.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.5b90000.20.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.432aae0.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R6093846s-Invoice-Receipt.exe.385f080.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R6093846s-Invoice-Receipt.exe.385f080.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.38dff64.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.38e458d.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.5b94629.21.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.432f109.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.38db12e.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.448b680.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.4325caa.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.420b931.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.448fca9.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.448684a.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.432aae0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.422c192.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.4217b65.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.484104685.0000000005B90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.470391681.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.479043770.0000000003891000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.480703873.0000000004486000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.305161176.000000000396B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.474458367.0000000002891000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.480187851.0000000004161000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.304879840.0000000003759000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6232, type: MEMORY

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\UALCBPTejUQxQ.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: R6093846s-Invoice-Receipt.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 20.2.RegSvcs.exe.5b90000.20.unpack	Avira: Label: TR/NanoCore.fadte
Source: 20.2.RegSvcs.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Compliance:

Uses 32bit PE files

Source: R6093846s-Invoice-Receipt.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: R6093846s-Invoice-Receipt.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\MyNanoCore RemoteScripting\MyClientPlugin\obj\Debug\MyClientPluginNew.pdb source: RegSvcs.exe, 00000014.00000002.480187851.0000000004161000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: RegSvcs.exe, 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\Daan\source\repos\NanoExploit\ClientTest\obj\Debug\ClientTest.pdb source: RegSvcs.exe, 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp
Source:	Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: RegSvcs.exe, 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp
Source:	Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: RegSvcs.exe, 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\Daan\source\repos\NanoExploit\ClientTest\obj\Debug\ClientTest.pdbS.m. _._CorDllMainmscoree.dll source: RegSvcs.exe, 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: RegSvcs.exe, 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]		20_2_06BA1D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]		20_2_06BA1D72

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49727 -> 185.244.26.194:8090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49737 -> 185.244.26.194:8090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49740 -> 185.244.26.194:8090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49746 -> 185.244.26.194:8090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49747 -> 185.244.26.194:8090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49748 -> 185.244.26.194:8090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49749 -> 185.244.26.194:8090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49752 -> 185.244.26.194:8090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49753 -> 185.244.26.194:8090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49754 -> 185.244.26.194:8090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49755 -> 185.244.26.194:8090
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49756 -> 185.244.26.194:8090

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: omaprilcode.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: omaprilcode.duckdns.org

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.3:49727 -> 185.244.26.194:8090

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: VAMU-ASIP-TRANSITVAMURU VAMU-ASIP-TRANSITVAMURU

Source: unknown

DNS traffic detected: queries for: omaprilcode.duckdns.org

Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: RegSvcs.exe, 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp	String found in binary or memory: http://google.com
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.297808598.0000000002751000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.318334259.000000000BCB2000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a raw input device (often for capturing keystrokes)

Source: RegSvcs.exe, 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Source: Yara match	File source: 20.2.RegSvcs.exe.5b90000.20.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.448b680.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.38dff64.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.5b90000.20.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.432aae0.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R6093846s-Invoice-Receipt.exe.385f080.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R6093846s-Invoice-Receipt.exe.385f080.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.38dff64.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.38e458d.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.5b94629.21.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.432f109.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.38db12e.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.448b680.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.4325caa.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.420b931.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.448fca9.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.448684a.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.432aae0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.422c192.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegSvcs.exe.4217b65.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.484104685.0000000005B90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.470391681.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.479043770.0000000003891000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.480703873.0000000004486000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.305161176.000000000396B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.474458367.0000000002891000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.480187851.0000000004161000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.304879840.0000000003759000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6232, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Source: 20.2.RegSvcs.exe.6b30000.32.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6190000.23.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6a80000.24.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6ac0000.26.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.4217b65.9.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.5b90000.20.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6b10000.31.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6b80000.36.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.448b680.14.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6b44c9f.35.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6b00000.30.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.38dff64.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.28be17c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6ac0000.26.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6b40000.34.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6af0000.29.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.5b90000.20.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6b4e8a4.33.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.432aae0.11.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.2914cd4.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.R6093846s-Invoice-Receipt.exe.385f080.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.R6093846s-Invoice-Receipt.exe.385f080.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.RegSvcs.exe.6a80000.24.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.R6093846s-Invoice-Receipt.exe.385f080.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.R6093846s-Invoice-Receipt.exe.385f080.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.RegSvcs.exe.38dff64.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.RegSvcs.exe.38e458d.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.5b94629.21.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.2914cd4.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6190000.23.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6ad0000.27.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6b30000.32.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6af0000.29.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6ae0000.28.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6ab0000.25.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6ae0000.28.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.432f109.13.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.RegSvcs.exe.6b80000.36.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.38db12e.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.38db12e.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.RegSvcs.exe.6b40000.34.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.448b680.14.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.RegSvcs.exe.5440000.18.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.6b10000.31.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.420b931.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.2920f1c.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.2920f1c.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.4325caa.12.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.RegSvcs.exe.2935558.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.420b931.10.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.RegSvcs.exe.448fca9.16.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.RegSvcs.exe.448684a.15.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.RegSvcs.exe.432aae0.11.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.RegSvcs.exe.422c192.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.RegSvcs.exe.422c192.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.RegSvcs.exe.4217b65.9.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000014.00000002.485019554.0000000006B10000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.484978078.0000000006AF0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.483826250.0000000005440000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.484104685.0000000005B90000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.485071825.0000000006B30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000014.00000002.470391681.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.470391681.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000014.00000002.484960992.0000000006AE0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.479043770.0000000003891000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000014.00000002.484915497.0000000006AC0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.484897789.0000000006AB0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.485130700.0000000006B80000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.480703873.0000000004486000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000014.00000002.484998886.0000000006B00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.484851372.0000000006A80000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.305161176.000000000396B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.305161176.000000000396B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000014.00000002.485085026.0000000006B40000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.484936957.0000000006AD0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.480187851.0000000004161000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000014.00000002.484499149.0000000006190000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.304879840.0000000003759000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.304879840.0000000003759000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: RegSvcs.exe PID: 6232, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: RegSvcs.exe PID: 6232, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: R6093846s-Invoice-Receipt.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_026F2293	0_2_026F2293
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_026F0473	0_2_026F0473
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_026F1060	0_2_026F1060
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_026F30B8	0_2_026F30B8
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_026F18D9	0_2_026F18D9
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_026F5898	0_2_026F5898
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_026F4BA8	0_2_026F4BA8
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_026F4BB8	0_2_026F4BB8
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_026F5220	0_2_026F5220
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_026F5230	0_2_026F5230
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_026F321C	0_2_026F321C
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_026F3329	0_2_026F3329
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_026F56C8	0_2_026F56C8
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_026F5438	0_2_026F5438
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_026F3572	0_2_026F3572
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_061902B0	20_2_061902B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_0276E471	20_2_0276E471
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_0276E480	20_2_0276E480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_0276BBD4	20_2_0276BBD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_06BA2528	20_2_06BA2528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_06BAA238	20_2_06BAA238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_06BAAB08	20_2_06BAAB08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_06BA0040	20_2_06BA0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_06BA31F0	20_2_06BA31F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_06BA9EF0	20_2_06BA9EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_06BA32AE	20_2_06BA32AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_06BAEA38	20_2_06BAEA38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_06BA00FE	20_2_06BA00FE

PE file contains strange resources

Source: R6093846s-Invoice-Receipt.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UALCBPTejUQxQ.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.298299117.00000000027C5000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs R6093846s-Invoice-Receipt.exe
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.301265309.0000000002A2D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameResource_Meter.dll> vs R6093846s-Invoice-Receipt.exe
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.307501982.0000000004C90000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs R6093846s-Invoice-Receipt.exe
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.295355680.00000000003DB000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamey34nz.exe2 vs R6093846s-Invoice-Receipt.exe
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.309371083.0000000005E10000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs R6093846s-Invoice-Receipt.exe
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.309371083.0000000005E10000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs R6093846s-Invoice-Receipt.exe
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.308198887.00000000052A0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs R6093846s-Invoice-Receipt.exe
Source: R6093846s-Invoice-Receipt.exe	Binary or memory string: OriginalFilenamey34nz.exe2 vs R6093846s-Invoice-Receipt.exe

Tries to load missing DLLs

Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe

Section loaded: onecoreuapcommonproxystub.dll

Source: R6093846s-Invoice-Receipt.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: UALCBPTejUQxQ.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 20.2.RegSvcs.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 20.2.RegSvcs.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 20.2.RegSvcs.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5812:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{f8dffc54-5ec5-4013-9de8-d8d853682f44}
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Mutant created: \Sessions\1\BaseNamedObjects\SjaOvCuaUGvC

Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe 'C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe'
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UALCBPTejUQxQ' /XML 'C:\Users\user\AppData\Local\Temp\tmpCCAD.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path}
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path}
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\UALCBPTejUQxQ' /XML 'C:\Users\user\AppData\Local\Temp\tmpCCAD.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path}	Jump to behavior

Source: R6093846s-Invoice-Receipt.exe, uNotepad/Form1.cs	.Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: UALCBPTejUQxQ.exe.0.dr, uNotepad/Form1.cs	.Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.R6093846s-Invoice-Receipt.exe.300000.0.unpack, uNotepad/Form1.cs	.Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.R6093846s-Invoice-Receipt.exe.300000.0.unpack, uNotepad/Form1.cs	.Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 20.2.RegSvcs.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 20.2.RegSvcs.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_0036A1F1 push 00000020h; iretd	0_2_0036A1F8
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Code function: 0_2_0036B9CD pushfd ; iretd	0_2_0036B9CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_06BA0EB0 push eax; retf	20_2_06BA0EB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_06BA1F20 push es; ret	20_2_06BA1F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_06BA1F00 push es; ret	20_2_06BA1F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_06BA1F40 push es; ret	20_2_06BA1F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 20_2_06BAC421 push es; ret	20_2_06BAC430

Source: initial sample	Static PE information: section name: .text entropy: 7.77156503233
Source: initial sample	Static PE information: section name: .text entropy: 7.77156503233

Source: 20.2.RegSvcs.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 20.2.RegSvcs.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.297808598.0000000002751000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.297808598.0000000002751000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 3307	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 6036	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: foregroundWindowGot 513	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: foregroundWindowGot 612	Jump to behavior

Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe TID: 3512	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe TID: 6240	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.297808598.0000000002751000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: RegSvcs.exe, 00000014.00000002.485282482.0000000006EE0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.297808598.0000000002751000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.297808598.0000000002751000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.297808598.0000000002751000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.297808598.0000000002751000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.297808598.0000000002751000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: RegSvcs.exe, 00000014.00000002.485282482.0000000006EE0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: RegSvcs.exe, 00000014.00000002.485282482.0000000006EE0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.297808598.0000000002751000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.297808598.0000000002751000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.297808598.0000000002751000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: RegSvcs.exe, 00000014.00000002.472769599.0000000000CAF000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegSvcs.exe, 00000014.00000002.485282482.0000000006EE0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 420000	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\R6093846s-Invoice-Receipt.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 719008	Jump to behavior

Source: RegSvcs.exe, 00000014.00000002.484719382.00000000067AC000.00000004.00000001.sdmp	Binary or memory string: Program Manager(
Source: RegSvcs.exe, 00000014.00000002.478278857.0000000002E2A000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: RegSvcs.exe, 00000014.00000002.473700881.00000000012C0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegSvcs.exe, 00000014.00000002.484152384.0000000005CEC000.00000004.00000001.sdmp	Binary or memory string: Program Manager\|<
Source: RegSvcs.exe, 00000014.00000002.484659379.000000000656C000.00000004.00000001.sdmp	Binary or memory string: Program Manager\|\
Source: RegSvcs.exe, 00000014.00000002.472879368.0000000000DCE000.00000004.00000001.sdmp	Binary or memory string: Program Manager"
Source: RegSvcs.exe, 00000014.00000002.473700881.00000000012C0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: RegSvcs.exe, 00000014.00000002.484443464.000000000604B000.00000004.00000001.sdmp	Binary or memory string: Program Manager\|\|
Source: RegSvcs.exe, 00000014.00000002.485937374.000000000883E000.00000004.00000001.sdmp	Binary or memory string: Program Managerram Manager
Source: RegSvcs.exe, 00000014.00000002.484770050.0000000006A6C000.00000004.00000001.sdmp	Binary or memory string: Program Managerram ManagerP
Source: RegSvcs.exe, 00000014.00000002.474705319.0000000002A0C000.00000004.00000001.sdmp	Binary or memory string: Program Manager\|$
Source: RegSvcs.exe, 00000014.00000002.474705319.0000000002A0C000.00000004.00000001.sdmp	Binary or memory string: Program Managerx
Source: RegSvcs.exe, 00000014.00000002.473700881.00000000012C0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: RegSvcs.exe, 00000014.00000002.474528779.00000000028FD000.00000004.00000001.sdmp	Binary or memory string: Program Managert
Source: RegSvcs.exe, 00000014.00000002.485957024.000000000897B000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: RegSvcs.exe, 00000014.00000002.485880655.00000000084BB000.00000004.00000001.sdmp	Binary or memory string: Program Managerram Manager\|
Source: RegSvcs.exe, 00000014.00000002.485893815.00000000085BE000.00000004.00000001.sdmp	Binary or memory string: Program Manager\|
Source: RegSvcs.exe, 00000014.00000002.473597627.0000000000F2E000.00000004.00000001.sdmp	Binary or memory string: Program Manager x

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

Source: R6093846s-Invoice-Receipt.exe, 00000000.00000002.305161176.000000000396B000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegSvcs.exe	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegSvcs.exe, 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: RegSvcs.exe, 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
Source: RegSvcs.exe, 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
Source: RegSvcs.exe, 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
Source: RegSvcs.exe, 00000014.00000002.480562084.0000000004325000.00000004.00000001.sdmp	String found in binary or memory: <Module>System.IOvalue__mscorlibConnectionStateChangedConnectionFailedPipeClosedPipeCreatedconnected<DataHost>k__BackingField<LoggingHost>k__BackingField<NetworkHost>k__BackingFieldBuildingHostCacheDownloadFileset_WindowStyleProcessWindowStyleset_FileNameGetFileNamepipeNameCreatePipeCommandTypeDebuggerBrowsableStateCompilerGeneratedAttributeGuidAttributeDebuggableAttributeDebuggerBrowsableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeDownloadExecutevalueStringPathIClientNetworkDownloadExecuteInternalClientTest.dllSystemEnumNanoCore.ClientPluginSystem.ReflectionExceptionFileInfoFileSystemInfoProcessStartInfo.ctorSystem.DiagnosticsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesDebuggingModesGetVariablesget_Attributesset_AttributesFileAttributesGetBuilderSettingsGetServerSettingsparamsGetConnectionsProcessInfectClientsObjectSystem.NetReadPacketWebClientStartportServerTestClientTestget_DataHostset_DataHostIClientDataHost_dataHostget_LoggingHostset_LoggingHostIClientLoggingHost_loggingHostget_NetworkHostset_NetworkHostIClientNetworkHost_networkHostNanoCore.ClientPluginHosthostset_CreateNoWindow?

ID:	452642
Product:	CloudBasic
Start time:	17:14:21
Start date:	22.07.2021
Sample:	R6093846s-Invoice-Receipt.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	cd0645cb78b55f0babbdbc4d51f23bd8
SHA1:	f5221832b2b4b7338bc21e42f7e2c983d82dbdf4
SHA256:	5b618273e08f4e9633ec359cff551345d0dabf0c64da9d3b5437d1c88c4bd226
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Windows Analysis Report R6093846s-Invoice-Receipt.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\R6093846s-Invoice-Receipt.exe.log	ASCII text, with CRLF line terminators	FED34146BF2F2FA59DCF8702FCC8232E	B03BFEA175989D989850CF06FE5E7BBF56EAA00A	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
C:\Users\user\AppData\Local\Temp\tmpCCAD.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	10825A068F66AFA5B707A7B3CDAB7FFF	2DD947530450B2144FA27C0947F8A3CC1088E075	AF1419ABF53B8CC7904C4909ACB750191BC45C248C266D22EB3C542F3D8B9C5B
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat	data	DF9DF69B9BDF9E9F14ACBA7F6AAA0439	F69C499EA98CB3B3FC303A8C19017F150D2FDAA1	172CAF6D0566CCDAD43210FC178D55B2D12F18070F4978B27AFBE2EECB904239
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat	ISO-8859 text, with no line terminators	87A19E60362ADB0A4C4DEDA315D07F62	6340BAD06709D73A2D2946AC49CB5FC77B1E4DA7	548F2F89D08DD063284AA4FEA0BE342B4BF8C1516613EA3DC945C294DE8816D8
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bak	data	ACD3FB4310417DC77FE06F15B0E353E6	80E7002E655EB5765FDEB21114295CB96AD9D5EB	DC3AE604991C9BB8FF8BC4502AE3D0DB8A3317512C0F432490B103B89C1A4368
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bin	data	BB0F9B9992809E733EFFF8B0E562CFD6	F0BAB3CF73A04F5A689E6AFC764FEE9276992742	C48F04FE7525AA3A3F9540889883F649726233DE021724823720A59B4F37CEAC
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\storage.dat	data	6AB7A5BD77B3380B3DAC6164123D58C8	1732E82902857F97E49541719EA46CFB88FCA68B	B89A2604B568E5D5435CE1885752739E481E83C08063DEA8FBC5CF271C0BA6D7
C:\Users\user\AppData\Roaming\UALCBPTejUQxQ.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	CD0645CB78B55F0BABBDBC4D51F23BD8	F5221832B2B4B7338BC21E42F7E2C983D82DBDF4	5B618273E08F4E9633EC359CFF551345D0DABF0C64DA9D3B5437D1C88C4BD226