Windows Analysis Report
Payment confirmation .exe

Overview

General Information

Sample Name: Payment confirmation .exe
Analysis ID: 559231
MD5: 0d98108aa5a3383c2c3152cf2cd5ae9a
SHA1: e08d7ba0bf0ac4f93d17e71d27a82dfb22058626
SHA256: 796f57da16fa76bd10afb6a16f9f75b78673f47556ce4d93d93ec34b5d898f61
Tags: exenanocore
Infos:

Detection

Nanocore
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Sigma detected: NanoCore
Yara detected AntiVM3
Detected Nanocore Rat
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Yara detected Nanocore RAT
Initial sample is a PE file and has a suspicious name
Connects to many ports of the same IP (likely port scanning)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Sigma detected: Suspicius Add Task From User AppData Temp
Machine Learning detection for sample
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Sigma detected: Powershell Defender Exclusion
.NET source code contains method to dynamically call methods (often used by packers)
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Adds a directory exclusion to Windows Defender
Hides that the sample has been downloaded from the Internet (zone.identifier)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Installs a raw input device (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Drops PE files
Detected TCP or UDP traffic on non-standard ports
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Found malware configuration
Source: 00000015.00000002.615775430.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "2616a878-9933-42e4-9fe0-3b57e29b", "Domain1": "naki.airdns.org", "Domain2": "37.120.210.211", "Port": 56281, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "faff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}
Multi AV Scanner detection for submitted file
Source: Payment confirmation .exe Virustotal: Detection: 31% Perma Link
Source: Payment confirmation .exe ReversingLabs: Detection: 32%
Antivirus detection for URL or domain
Source: 37.120.210.211 Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\iBGUhLU.exe ReversingLabs: Detection: 32%
Yara detected Nanocore RAT
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.6070000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.6074629.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3ef5c98.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e82a86.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3d0cc08.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e878bc.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e878bc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.6070000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e8bee5.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3d0cc08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3ef5c98.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000000.553341686.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.615775430.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.552240141.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.562434427.0000000003D0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.621380442.0000000006070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.617626488.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.554000137.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.612866743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.554553035.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.563113379.0000000003EF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Payment confirmation .exe PID: 4540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Payment confirmation .exe PID: 5116, type: MEMORYSTR
Machine Learning detection for sample
Source: Payment confirmation .exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\iBGUhLU.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 21.0.Payment confirmation .exe.400000.10.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 21.0.Payment confirmation .exe.400000.4.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 21.0.Payment confirmation .exe.400000.12.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 21.2.Payment confirmation .exe.400000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 21.0.Payment confirmation .exe.400000.6.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 21.2.Payment confirmation .exe.6070000.9.unpack Avira: Label: TR/NanoCore.fadte
Source: 21.0.Payment confirmation .exe.400000.8.unpack Avira: Label: TR/Dropper.MSIL.Gen7

Compliance
barindex
Uses 32bit PE files
Source: Payment confirmation .exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Source: Payment confirmation .exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 146.70.76.43 ports 56281,1,2,5,6,8
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 37.120.210.211
Source: Malware configuration extractor URLs: naki.airdns.org
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TENET-1ZA TENET-1ZA
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.6:49811 -> 146.70.76.43:56281
Source: Payment confirmation .exe, 00000000.00000003.357486991.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.357630236.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.357683121.0000000005CDA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://en.w
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.356117157.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.356378144.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.356305451.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: Payment confirmation .exe, 00000000.00000003.357825255.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.357302229.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.357469019.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.357024345.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.357977143.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.356575956.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.356445695.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.356700406.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.356887648.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.357619118.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.357149641.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.como
Source: Payment confirmation .exe, 00000000.00000003.356378144.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.comug
Source: Payment confirmation .exe, 00000000.00000002.559797997.0000000002D01000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Payment confirmation .exe, 00000000.00000003.367855914.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: Payment confirmation .exe, 00000000.00000003.367709317.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html%
Source: Payment confirmation .exe, 00000000.00000003.365423276.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com
Source: Payment confirmation .exe, 00000000.00000003.364863222.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365010134.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com3
Source: Payment confirmation .exe, 00000000.00000003.364507204.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364863222.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364016052.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365155998.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364641374.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364361805.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365010134.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364219785.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365290423.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365423276.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com9
Source: Payment confirmation .exe, 00000000.00000003.364361805.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comac
Source: Payment confirmation .exe, 00000000.00000003.365155998.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365290423.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365423276.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comc
Source: Payment confirmation .exe, 00000000.00000003.365623717.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365906076.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365155998.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365546838.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365769728.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365290423.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365423276.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comces
Source: Payment confirmation .exe, 00000000.00000003.364507204.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comcyK
Source: Payment confirmation .exe, 00000000.00000003.365155998.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365290423.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365423276.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comesH
Source: Payment confirmation .exe, 00000000.00000003.365623717.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365906076.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365546838.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365769728.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365423276.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comhly
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Payment confirmation .exe, 00000000.00000003.363863872.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364507204.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366147501.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365623717.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365906076.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363495280.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364863222.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364016052.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363634963.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366265697.0000000005CD4000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365155998.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364641374.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365546838.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364361805.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366326585.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366030122.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365769728.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365010134.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364219785.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365290423.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365423276.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comlg
Source: Payment confirmation .exe, 00000000.00000003.363863872.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364507204.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366147501.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365623717.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365906076.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366744577.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364863222.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364016052.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366465674.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366265697.0000000005CD4000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365155998.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364641374.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365546838.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364361805.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366326585.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366030122.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365769728.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366668074.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365010134.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364219785.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365290423.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comm
Source: Payment confirmation .exe, 00000000.00000003.365155998.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365290423.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365423276.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comn-u
Source: Payment confirmation .exe, 00000000.00000003.363863872.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364016052.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363634963.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comncyI
Source: Payment confirmation .exe, 00000000.00000003.364507204.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366147501.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365623717.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365906076.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364863222.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366265697.0000000005CD4000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365155998.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364641374.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365546838.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366326585.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366030122.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365769728.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365010134.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365290423.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365423276.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comr-t
Source: Payment confirmation .exe, 00000000.00000003.364863222.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365155998.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365010134.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365290423.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365423276.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comso
Source: Payment confirmation .exe, 00000000.00000003.366147501.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365623717.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365906076.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366744577.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366465674.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366265697.0000000005CD4000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365155998.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366935086.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365546838.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.367218271.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.367116516.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366326585.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366030122.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365769728.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366668074.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365290423.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365423276.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366592843.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comt0
Source: Payment confirmation .exe, 00000000.00000003.363863872.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364507204.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366147501.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365623717.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365906076.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364863222.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364016052.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363634963.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366265697.0000000005CD4000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365155998.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364641374.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365546838.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364361805.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366326585.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366030122.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365769728.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365010134.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364219785.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365290423.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365423276.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comth
Source: Payment confirmation .exe, 00000000.00000003.364507204.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366147501.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365623717.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365906076.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364863222.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366465674.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366265697.0000000005CD4000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365155998.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364641374.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365546838.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364361805.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366326585.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366030122.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365769728.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366668074.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365010134.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364219785.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365290423.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365423276.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366592843.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comva&
Source: Payment confirmation .exe, 00000000.00000003.363863872.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364016052.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comypo
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Payment confirmation .exe, 00000000.00000003.393018990.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.373895893.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.380893532.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.374935499.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.382778780.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.376425938.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.381168425.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Payment confirmation .exe, 00000000.00000003.380694836.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.393018990.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.393142180.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers%
Source: Payment confirmation .exe, 00000000.00000003.373895893.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.374545461.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.374384052.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Payment confirmation .exe, 00000000.00000003.382357060.0000000005CEE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlH
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Payment confirmation .exe, 00000000.00000003.382357060.0000000005CEE000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.382554954.0000000005CEE000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.382497875.0000000005CEE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmle
Source: Payment confirmation .exe, 00000000.00000003.380972243.0000000005CEE000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.381322016.0000000005CEE000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.381187839.0000000005CEE000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.381501028.0000000005CEE000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.381061897.0000000005CEE000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.380504872.0000000005CEE000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.380770592.0000000005CEE000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.380416970.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Payment confirmation .exe, 00000000.00000003.383170261.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersB
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Payment confirmation .exe, 00000000.00000003.383170261.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersb
Source: Payment confirmation .exe, 00000000.00000003.376830096.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.376667085.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.376425938.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersc
Source: Payment confirmation .exe, 00000000.00000003.376137586.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.376425938.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersh
Source: Payment confirmation .exe, 00000000.00000003.376667085.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.376137586.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.374935499.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.376425938.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers~
Source: Payment confirmation .exe, 00000000.00000002.559399340.00000000012C7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comdia
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: Payment confirmation .exe, 00000000.00000003.361861660.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362900001.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364219785.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Payment confirmation .exe, 00000000.00000003.362259718.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362098396.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362442942.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Payment confirmation .exe, 00000000.00000003.362608382.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362684991.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362259718.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362098396.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362442942.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnK
Source: Payment confirmation .exe, 00000000.00000003.362608382.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362684991.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362259718.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362098396.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362442942.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnl
Source: Payment confirmation .exe, 00000000.00000003.362608382.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362684991.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363185032.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362259718.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363056742.0000000005CD4000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362098396.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362442942.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362900001.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnls(
Source: Payment confirmation .exe, 00000000.00000003.362608382.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362684991.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362259718.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362098396.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362442942.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnmpa
Source: Payment confirmation .exe, 00000000.00000003.363863872.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362608382.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364507204.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362684991.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363185032.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363495280.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362259718.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364863222.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364016052.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363634963.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363056742.0000000005CD4000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362098396.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363356203.0000000005CCD000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362442942.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365155998.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364641374.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.361861660.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365546838.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362900001.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364361805.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365010134.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnno
Source: Payment confirmation .exe, 00000000.00000003.362098396.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnrm
Source: Payment confirmation .exe, 00000000.00000003.362608382.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362684991.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362259718.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362098396.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362442942.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cnsof0
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Payment confirmation .exe, 00000000.00000003.386807451.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.386605316.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.387075190.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.387222007.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.386931372.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmo
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.360704375.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Payment confirmation .exe, 00000000.00000003.360704375.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr-c
Source: Payment confirmation .exe, 00000000.00000003.360704375.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.krmn-u
Source: Payment confirmation .exe, 00000000.00000002.559797997.0000000002D01000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.google.com
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Payment confirmation .exe, 00000000.00000003.386028171.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.monotype.
Source: Payment confirmation .exe, 00000000.00000003.353514887.0000000005CB2000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Payment confirmation .exe, 00000000.00000003.353514887.0000000005CB2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.comno.
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.367781250.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: Payment confirmation .exe, 00000000.00000003.368239598.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.368365048.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.368048501.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.367781250.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.367855914.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.comd
Source: Payment confirmation .exe, 00000000.00000003.360911622.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.361056673.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.360528445.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.360704375.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Payment confirmation .exe, 00000000.00000003.360704375.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.krTF
Source: Payment confirmation .exe, 00000000.00000003.360704375.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr_
Source: Payment confirmation .exe, 00000000.00000003.360528445.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.360704375.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.krs-c
Source: Payment confirmation .exe, 00000000.00000003.365546838.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.362814594.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365769728.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: Payment confirmation .exe, 00000000.00000003.362814594.00000000012CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.coms
Source: Payment confirmation .exe, 00000000.00000003.365623717.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365546838.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.comslnt
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: Payment confirmation .exe, 00000000.00000003.372633234.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.383309388.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.383712360.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.383422790.0000000005CD7000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.372433937.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.383830654.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.372152219.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.383630749.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.383516270.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.de
Source: Payment confirmation .exe, 00000000.00000002.567198922.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Payment confirmation .exe, 00000000.00000003.372633234.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.372433937.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.372152219.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deg
Source: Payment confirmation .exe, 00000000.00000003.372633234.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.372433937.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.372152219.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.de~
Source: Payment confirmation .exe, 00000000.00000003.363356203.0000000005CCD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Payment confirmation .exe, 00000000.00000003.363863872.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364507204.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366147501.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365623717.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365906076.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363495280.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364863222.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364016052.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363634963.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363356203.0000000005CCD000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366265697.0000000005CD4000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365155998.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364641374.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365546838.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364361805.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366326585.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.366030122.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365769728.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365010134.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364219785.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365290423.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cnk
Source: Payment confirmation .exe, 00000000.00000003.363863872.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364507204.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363495280.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364863222.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364016052.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363634963.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363356203.0000000005CCD000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364641374.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364361805.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365010134.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364219785.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cnls(
Source: Payment confirmation .exe, 00000000.00000003.363863872.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364507204.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363495280.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364863222.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364016052.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363634963.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.363356203.0000000005CCD000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364641374.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364361805.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.365010134.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000000.00000003.364219785.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cno.V
Source: unknown DNS traffic detected: queries for: naki.airdns.org

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Installs a raw input device (often for capturing keystrokes)
Source: Payment confirmation .exe, 00000015.00000002.617626488.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: RegisterRawInputDevices

E-Banking Fraud
barindex
Yara detected Nanocore RAT
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.6070000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.6074629.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3ef5c98.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e82a86.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3d0cc08.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e878bc.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e878bc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.6070000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e8bee5.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3d0cc08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3ef5c98.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000000.553341686.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.615775430.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.552240141.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.562434427.0000000003D0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.621380442.0000000006070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.617626488.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.554000137.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.612866743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.554553035.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.563113379.0000000003EF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Payment confirmation .exe PID: 4540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Payment confirmation .exe PID: 5116, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 21.2.Payment confirmation .exe.6800000.12.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.Payment confirmation .exe.6804c9f.11.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.0.Payment confirmation .exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.0.Payment confirmation .exe.400000.10.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 21.0.Payment confirmation .exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.0.Payment confirmation .exe.400000.4.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 21.2.Payment confirmation .exe.6800000.12.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.Payment confirmation .exe.6070000.9.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.Payment confirmation .exe.5390000.6.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.Payment confirmation .exe.6074629.8.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.0.Payment confirmation .exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.0.Payment confirmation .exe.400000.12.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Payment confirmation .exe.3ef5c98.6.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Payment confirmation .exe.3ef5c98.6.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 21.2.Payment confirmation .exe.3e82a86.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.Payment confirmation .exe.3e82a86.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Payment confirmation .exe.3d0cc08.3.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Payment confirmation .exe.3d0cc08.3.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 21.2.Payment confirmation .exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.Payment confirmation .exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 21.2.Payment confirmation .exe.3e878bc.3.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.Payment confirmation .exe.3e878bc.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.Payment confirmation .exe.680e8a4.10.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.Payment confirmation .exe.6070000.9.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.Payment confirmation .exe.2e59678.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.0.Payment confirmation .exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.0.Payment confirmation .exe.400000.8.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 21.0.Payment confirmation .exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.0.Payment confirmation .exe.400000.6.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 21.2.Payment confirmation .exe.3e8bee5.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Payment confirmation .exe.3d0cc08.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Payment confirmation .exe.3d0cc08.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Payment confirmation .exe.3ef5c98.6.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Payment confirmation .exe.3ef5c98.6.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000015.00000000.553341686.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000015.00000000.553341686.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000015.00000002.615775430.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000015.00000000.552240141.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000015.00000000.552240141.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.562434427.0000000003D0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.562434427.0000000003D0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000015.00000002.621380442.0000000006070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000015.00000002.617626488.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000015.00000000.554000137.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000015.00000000.554000137.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000015.00000002.612866743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000015.00000002.612866743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000015.00000002.621567698.0000000006800000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000015.00000002.620905175.0000000005390000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000015.00000000.554553035.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000015.00000000.554553035.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.563113379.0000000003EF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.563113379.0000000003EF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Payment confirmation .exe PID: 4540, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Payment confirmation .exe PID: 4540, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Payment confirmation .exe PID: 5116, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Payment confirmation .exe PID: 5116, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Payment confirmation .exe
Uses 32bit PE files
Source: Payment confirmation .exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Yara signature match
Source: 21.2.Payment confirmation .exe.6800000.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.Payment confirmation .exe.6800000.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.Payment confirmation .exe.6804c9f.11.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.Payment confirmation .exe.6804c9f.11.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.0.Payment confirmation .exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.0.Payment confirmation .exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.0.Payment confirmation .exe.400000.10.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 21.0.Payment confirmation .exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.0.Payment confirmation .exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.0.Payment confirmation .exe.400000.4.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 21.2.Payment confirmation .exe.6800000.12.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.Payment confirmation .exe.6800000.12.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.Payment confirmation .exe.6070000.9.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.Payment confirmation .exe.6070000.9.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.Payment confirmation .exe.5390000.6.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.Payment confirmation .exe.5390000.6.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.Payment confirmation .exe.6074629.8.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.Payment confirmation .exe.6074629.8.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.0.Payment confirmation .exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.0.Payment confirmation .exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.0.Payment confirmation .exe.400000.12.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Payment confirmation .exe.3ef5c98.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Payment confirmation .exe.3ef5c98.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Payment confirmation .exe.3ef5c98.6.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 21.2.Payment confirmation .exe.3e82a86.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.Payment confirmation .exe.3e82a86.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.Payment confirmation .exe.3e82a86.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Payment confirmation .exe.3d0cc08.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Payment confirmation .exe.3d0cc08.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Payment confirmation .exe.3d0cc08.3.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 21.2.Payment confirmation .exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.Payment confirmation .exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.Payment confirmation .exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 21.2.Payment confirmation .exe.3e878bc.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.Payment confirmation .exe.3e878bc.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.Payment confirmation .exe.3e878bc.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.Payment confirmation .exe.3e878bc.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.Payment confirmation .exe.680e8a4.10.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.Payment confirmation .exe.680e8a4.10.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.Payment confirmation .exe.6070000.9.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.Payment confirmation .exe.6070000.9.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.Payment confirmation .exe.2e59678.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.Payment confirmation .exe.2e59678.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.0.Payment confirmation .exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.0.Payment confirmation .exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.0.Payment confirmation .exe.400000.8.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 21.0.Payment confirmation .exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.0.Payment confirmation .exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.0.Payment confirmation .exe.400000.6.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 21.2.Payment confirmation .exe.3e8bee5.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.Payment confirmation .exe.3e8bee5.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Payment confirmation .exe.3d0cc08.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Payment confirmation .exe.3d0cc08.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Payment confirmation .exe.3ef5c98.6.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Payment confirmation .exe.3ef5c98.6.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000015.00000000.553341686.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000015.00000000.553341686.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000015.00000002.615775430.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000015.00000000.552240141.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000015.00000000.552240141.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.562434427.0000000003D0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.562434427.0000000003D0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000015.00000002.621380442.0000000006070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000015.00000002.621380442.0000000006070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000015.00000002.617626488.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000015.00000000.554000137.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000015.00000000.554000137.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000015.00000002.612866743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000015.00000002.612866743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000015.00000002.621567698.0000000006800000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000015.00000002.621567698.0000000006800000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000015.00000002.620905175.0000000005390000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000015.00000002.620905175.0000000005390000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000015.00000000.554553035.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000015.00000000.554553035.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.563113379.0000000003EF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.563113379.0000000003EF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Payment confirmation .exe PID: 4540, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Payment confirmation .exe PID: 4540, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Payment confirmation .exe PID: 5116, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Payment confirmation .exe PID: 5116, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Detected potential crypto function
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 0_2_02BB6F80 0_2_02BB6F80
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 0_2_02BB6F72 0_2_02BB6F72
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 0_2_02BB6D30 0_2_02BB6D30
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 0_2_02BB6D22 0_2_02BB6D22
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 0_2_05794454 0_2_05794454
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 0_2_0579C658 0_2_0579C658
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 0_2_05792330 0_2_05792330
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 0_2_05790D94 0_2_05790D94
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 0_2_05791C18 0_2_05791C18
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 0_2_0758DDA8 0_2_0758DDA8
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 0_2_07582102 0_2_07582102
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 0_2_07585770 0_2_07585770
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 0_2_07585508 0_2_07585508
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 21_2_0119E471 21_2_0119E471
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 21_2_0119E480 21_2_0119E480
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 21_2_0119BBD4 21_2_0119BBD4
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 21_2_05376550 21_2_05376550
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 21_2_05373E30 21_2_05373E30
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 21_2_0537BED8 21_2_0537BED8
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 21_2_05374A50 21_2_05374A50
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 21_2_0537CAF0 21_2_0537CAF0
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 21_2_05374B08 21_2_05374B08
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 21_2_0537CBAE 21_2_0537CBAE
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\Payment confirmation .exe Process Stats: CPU usage > 98%
Sample file is different than original file name gathered from version info
Source: Payment confirmation .exe, 00000000.00000002.558685046.0000000000A66000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameObjRefSurroga.exe0 vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000000.00000002.567565837.00000000074C0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000000.00000002.562434427.0000000003D0C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000000.00000002.559797997.0000000002D01000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000000.00000002.567891113.0000000007690000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000000.00000002.563113379.0000000003EF5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000015.00000000.550290214.00000000009E6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameObjRefSurroga.exe0 vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000015.00000002.615775430.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSurveillanceClientPlugin.dll4 vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000015.00000002.615775430.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000015.00000002.617626488.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000015.00000002.617626488.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLzma#.dll4 vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000015.00000002.617626488.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000015.00000002.617626488.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAForge.Video.DirectShow.dll4 vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000015.00000002.617626488.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNAudio.dll4 vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000015.00000002.617626488.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSurveillanceClientPlugin.dll4 vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000015.00000002.621380442.0000000006070000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameLzma#.dll4 vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000015.00000002.621380442.0000000006070000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000015.00000002.620905175.0000000005390000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000015.00000002.621567698.0000000006800000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameAForge.Video.DirectShow.dll4 vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000015.00000002.621567698.0000000006800000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameNAudio.dll4 vs Payment confirmation .exe
Source: Payment confirmation .exe, 00000015.00000002.621567698.0000000006800000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSurveillanceClientPlugin.dll4 vs Payment confirmation .exe
Source: Payment confirmation .exe Binary or memory string: OriginalFilenameObjRefSurroga.exe0 vs Payment confirmation .exe
Source: Payment confirmation .exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: iBGUhLU.exe.0.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Payment confirmation .exe Virustotal: Detection: 31%
Source: Payment confirmation .exe ReversingLabs: Detection: 32%
Source: C:\Users\user\Desktop\Payment confirmation .exe File read: C:\Users\user\Desktop\Payment confirmation .exe Jump to behavior
Source: Payment confirmation .exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Payment confirmation .exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Payment confirmation .exe "C:\Users\user\Desktop\Payment confirmation .exe"
Source: C:\Users\user\Desktop\Payment confirmation .exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iBGUhLU.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment confirmation .exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iBGUhLU" /XML "C:\Users\user\AppData\Local\Temp\tmp2497.tmp
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payment confirmation .exe Process created: C:\Users\user\Desktop\Payment confirmation .exe C:\Users\user\Desktop\Payment confirmation .exe
Source: C:\Users\user\Desktop\Payment confirmation .exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iBGUhLU.exe Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iBGUhLU" /XML "C:\Users\user\AppData\Local\Temp\tmp2497.tmp Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process created: C:\Users\user\Desktop\Payment confirmation .exe C:\Users\user\Desktop\Payment confirmation .exe Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe File created: C:\Users\user\AppData\Roaming\iBGUhLU.exe Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe File created: C:\Users\user\AppData\Local\Temp\tmp2497.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@9/9@2/1
Source: C:\Users\user\Desktop\Payment confirmation .exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: 21.0.Payment confirmation .exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 21.0.Payment confirmation .exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 21.0.Payment confirmation .exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 21.0.Payment confirmation .exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 21.0.Payment confirmation .exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 21.0.Payment confirmation .exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: C:\Users\user\Desktop\Payment confirmation .exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5732:120:WilError_01
Source: C:\Users\user\Desktop\Payment confirmation .exe Mutant created: \Sessions\1\BaseNamedObjects\NFjYqzvaoo
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5004:120:WilError_01
Source: C:\Users\user\Desktop\Payment confirmation .exe Mutant created: \Sessions\1\BaseNamedObjects\Global\{2616a878-9933-42e4-9fe0-3b57e29bc1f5}
Source: Payment confirmation .exe, nW/bWj.cs Cryptographic APIs: 'CreateDecryptor'
Source: Payment confirmation .exe, nW/bWj.cs Cryptographic APIs: 'CreateDecryptor'
Source: iBGUhLU.exe.0.dr, nW/bWj.cs Cryptographic APIs: 'CreateDecryptor'
Source: iBGUhLU.exe.0.dr, nW/bWj.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.Payment confirmation .exe.970000.0.unpack, nW/bWj.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.Payment confirmation .exe.970000.0.unpack, nW/bWj.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Payment confirmation .exe.970000.0.unpack, nW/bWj.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Payment confirmation .exe.970000.0.unpack, nW/bWj.cs Cryptographic APIs: 'CreateDecryptor'
Source: 21.0.Payment confirmation .exe.8f0000.9.unpack, nW/bWj.cs Cryptographic APIs: 'CreateDecryptor'
Source: 21.0.Payment confirmation .exe.8f0000.9.unpack, nW/bWj.cs Cryptographic APIs: 'CreateDecryptor'
Source: 21.0.Payment confirmation .exe.8f0000.11.unpack, nW/bWj.cs Cryptographic APIs: 'CreateDecryptor'
Source: 21.0.Payment confirmation .exe.8f0000.11.unpack, nW/bWj.cs Cryptographic APIs: 'CreateDecryptor'
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Payment confirmation .exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Payment confirmation .exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Payment confirmation .exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 21.0.Payment confirmation .exe.400000.10.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 21.0.Payment confirmation .exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 21.0.Payment confirmation .exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 21.0.Payment confirmation .exe.400000.4.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 21.0.Payment confirmation .exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 21.0.Payment confirmation .exe.400000.12.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
.NET source code contains method to dynamically call methods (often used by packers)
Source: Payment confirmation .exe, nW/bWj.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: iBGUhLU.exe.0.dr, nW/bWj.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.0.Payment confirmation .exe.970000.0.unpack, nW/bWj.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.2.Payment confirmation .exe.970000.0.unpack, nW/bWj.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 21.0.Payment confirmation .exe.8f0000.9.unpack, nW/bWj.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 21.0.Payment confirmation .exe.8f0000.11.unpack, nW/bWj.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 21.0.Payment confirmation .exe.8f0000.1.unpack, nW/bWj.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 21.0.Payment confirmation .exe.8f0000.0.unpack, nW/bWj.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 0_2_07310C15 push FFFFFF8Bh; iretd 0_2_07310C17
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 21_2_065618FC push E802005Eh; retf 21_2_06561901
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 21_2_06561912 pushad ; retf 21_2_06561929
Source: C:\Users\user\Desktop\Payment confirmation .exe Code function: 21_2_06561904 push E801035Eh; ret 21_2_06561909
Source: initial sample Static PE information: section name: .text entropy: 7.86642009336
Source: initial sample Static PE information: section name: .text entropy: 7.86642009336
Source: 21.0.Payment confirmation .exe.400000.10.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 21.0.Payment confirmation .exe.400000.10.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 21.0.Payment confirmation .exe.400000.4.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 21.0.Payment confirmation .exe.400000.4.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 21.0.Payment confirmation .exe.400000.12.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 21.0.Payment confirmation .exe.400000.12.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='

Persistence and Installation Behavior
barindex
Drops PE files
Source: C:\Users\user\Desktop\Payment confirmation .exe File created: C:\Users\user\AppData\Roaming\iBGUhLU.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\Payment confirmation .exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iBGUhLU" /XML "C:\Users\user\AppData\Local\Temp\tmp2497.tmp

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\Payment confirmation .exe File opened: C:\Users\user\Desktop\Payment confirmation .exe:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\Payment confirmation .exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.Payment confirmation .exe.2d2f510.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.2d3e02c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.559797997.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Payment confirmation .exe PID: 4540, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Payment confirmation .exe, 00000000.00000002.559797997.0000000002D01000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: Payment confirmation .exe, 00000000.00000002.559797997.0000000002D01000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Payment confirmation .exe TID: 5584 Thread sleep time: -34001s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe TID: 5408 Thread sleep time: -62000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe TID: 5728 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3456 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe TID: 1352 Thread sleep time: -10145709240540247s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Payment confirmation .exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6227 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2358 Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Window / User API: threadDelayed 3363 Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Window / User API: threadDelayed 5848 Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Thread delayed: delay time: 34001 Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Payment confirmation .exe, 00000000.00000002.559797997.0000000002D01000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: Payment confirmation .exe, 00000000.00000002.559797997.0000000002D01000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Payment confirmation .exe, 00000000.00000002.559797997.0000000002D01000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: Payment confirmation .exe, 00000000.00000002.559797997.0000000002D01000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging
barindex
Enables debug privileges
Source: C:\Users\user\Desktop\Payment confirmation .exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Payment confirmation .exe Memory written: C:\Users\user\Desktop\Payment confirmation .exe base: 400000 value starts with: 4D5A Jump to behavior
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\Payment confirmation .exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iBGUhLU.exe
Source: C:\Users\user\Desktop\Payment confirmation .exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iBGUhLU.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Payment confirmation .exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iBGUhLU.exe Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iBGUhLU" /XML "C:\Users\user\AppData\Local\Temp\tmp2497.tmp Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Process created: C:\Users\user\Desktop\Payment confirmation .exe C:\Users\user\Desktop\Payment confirmation .exe Jump to behavior
Source: Payment confirmation .exe, 00000015.00000002.617436294.0000000002E92000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager|$,
Source: Payment confirmation .exe, 00000015.00000002.617591812.0000000002FF8000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000015.00000002.617574269.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000015.00000002.621629051.000000000696E000.00000004.00000010.00020000.00000000.sdmp, Payment confirmation .exe, 00000015.00000002.617436294.0000000002E92000.00000004.00000800.00020000.00000000.sdmp, Payment confirmation .exe, 00000015.00000002.621303249.0000000005EAB000.00000004.00000010.00020000.00000000.sdmp, Payment confirmation .exe, 00000015.00000002.621509072.000000000654E000.00000004.00000010.00020000.00000000.sdmp, Payment confirmation .exe, 00000015.00000002.621454017.00000000061CD000.00000004.00000010.00020000.00000000.sdmp, Payment confirmation .exe, 00000015.00000002.621476746.000000000630F000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: Payment confirmation .exe, 00000015.00000002.617436294.0000000002E92000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager(h
Source: Payment confirmation .exe, 00000015.00000002.617436294.0000000002E92000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Managerx

Language, Device and Operating System Detection
barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Users\user\Desktop\Payment confirmation .exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Users\user\Desktop\Payment confirmation .exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Payment confirmation .exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Nanocore RAT
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.6070000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.6074629.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3ef5c98.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e82a86.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3d0cc08.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e878bc.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e878bc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.6070000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e8bee5.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3d0cc08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3ef5c98.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000000.553341686.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.615775430.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.552240141.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.562434427.0000000003D0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.621380442.0000000006070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.617626488.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.554000137.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.612866743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.554553035.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.563113379.0000000003EF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Payment confirmation .exe PID: 4540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Payment confirmation .exe PID: 5116, type: MEMORYSTR

Remote Access Functionality
barindex
Detected Nanocore Rat
Source: Payment confirmation .exe, 00000000.00000002.562434427.0000000003D0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Payment confirmation .exe, 00000000.00000002.563113379.0000000003EF5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Payment confirmation .exe, 00000015.00000002.615775430.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Payment confirmation .exe, 00000015.00000002.615775430.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: Payment confirmation .exe, 00000015.00000000.553341686.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Payment confirmation .exe, 00000015.00000002.617626488.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Payment confirmation .exe, 00000015.00000002.617626488.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: Payment confirmation .exe, 00000015.00000002.621380442.0000000006070000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Payment confirmation .exe, 00000015.00000002.620905175.0000000005390000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: Payment confirmation .exe, 00000015.00000002.620905175.0000000005390000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: Payment confirmation .exe, 00000015.00000002.621567698.0000000006800000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Yara detected Nanocore RAT
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.6070000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.6074629.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3ef5c98.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e82a86.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3d0cc08.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e878bc.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e878bc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.6070000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.Payment confirmation .exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Payment confirmation .exe.3e8bee5.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3d0cc08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Payment confirmation .exe.3ef5c98.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000000.553341686.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.615775430.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.552240141.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.562434427.0000000003D0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.621380442.0000000006070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.617626488.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.554000137.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.612866743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.554553035.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.563113379.0000000003EF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Payment confirmation .exe PID: 4540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Payment confirmation .exe PID: 5116, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 559231 Sample: Payment confirmation .exe Startdate: 25/01/2022 Architecture: WINDOWS Score: 100 35 naki.airdns.org 2->35 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus detection for URL or domain 2->43 45 18 other signatures 2->45 8 Payment confirmation .exe 7 2->8         started        signatures3 process4 file5 25 C:\Users\user\AppData\Roaming\iBGUhLU.exe, PE32 8->25 dropped 27 C:\Users\user\...\iBGUhLU.exe:Zone.Identifier, ASCII 8->27 dropped 29 C:\Users\user\AppData\Local\...\tmp2497.tmp, XML 8->29 dropped 31 C:\Users\...\Payment confirmation .exe.log, ASCII 8->31 dropped 47 Adds a directory exclusion to Windows Defender 8->47 49 Injects a PE file into a foreign processes 8->49 12 Payment confirmation .exe 6 8->12         started        17 powershell.exe 23 8->17         started        19 schtasks.exe 1 8->19         started        signatures6 process7 dnsIp8 37 naki.airdns.org 146.70.76.43, 56281 TENET-1ZA United Kingdom 12->37 33 C:\Users\user\AppData\Roaming\...\run.dat, data 12->33 dropped 51 Hides that the sample has been downloaded from the Internet (zone.identifier) 12->51 21 conhost.exe 17->21         started        23 conhost.exe 19->23         started        file9 signatures10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
146.70.76.43
 naki.airdns.org United Kingdom
2018 TENET-1ZA true

Contacted Domains

Name IP Active
naki.airdns.org 146.70.76.43 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
37.120.210.211 true
  • 4%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
naki.airdns.org true
  • Avira URL Cloud: safe
 unknown
0,0,343003226,0000000000A68000,00000002,00000001,01000000,00000003,3,D7A61577F9C39F0C true
    		low