Analysis Report 256ec8f8f67b59c5e085b0bb63afcd13.exe

Overview

General Information

Sample Name:	256ec8f8f67b59c5e085b0bb63afcd13.exe
Analysis ID:	355753
MD5:	0bbcc2e64e3edf053ed4af2c0bafb0eb
SHA1:	c006b8d2ec4b92f441815b20f1bdadf98eab1b4d
SHA256:	52d01903f7c366e01359a00ea771ca1f71d4e1bb54731290bc62c3a218f5af80
Tags:	exeNanoCoreRAT
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Sigma detected: Scheduled temp file as task from temp location

Yara detected Nanocore RAT

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Signatures

AV Detection:

Found malware configuration

Source: 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "94----", "Group": "V-HASH", "Domain1": "cloudhost.myfirewall.org", "Domain2": "cloudhost.myfirewall.org", "Port": 5654, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "cloudhost.myfirewall.org", "BackupDNSServer": "cloudhost.myfirewall.orgbxpU=", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}

Yara detected Nanocore RAT

Source: Yara match	File source: 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.742370218.0000000002FB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.721168712.0000000004471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.905880969.0000000004057000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.722411296.0000000004371000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6416, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5748, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2460, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6720, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6888, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 7160, type: MEMORY
Source: Yara match	File source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6260, type: MEMORY
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6500, type: MEMORY
Source: Yara match	File source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3ffeab4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3c7ffe0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.46f8490.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.459ffe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3d78490.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43beab4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.45fffe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43c30dd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3ffeab4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.40630dd.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.dhcpmon.exe.46f8490.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c30dd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c24629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3d78490.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.43cffe0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.dhcpmon.exe.40030dd.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43b9c7e.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.43beab4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.raw.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.unpack	Avira: Label: TR/NanoCore.fadte
Source: 12.2.dhcpmon.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 14.2.dhcpmon.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Compliance:

Uses 32bit PE files

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses new MSVCR Dlls

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source:	Binary string: indows\mscorlib.pdbpdblib.pdb source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.904860246.0000000002A85000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.680575404.0000000008770000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907073740.0000000005920000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.717914840.00000000082E0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.724995186.00000000076E0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.734162357.0000000008310000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 4x nop then lea ecx, dword ptr [ebp-30h]	0_2_05470608
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 4x nop then lea ecx, dword ptr [ebp-30h]	7_2_055C0608
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 4x nop then lea ecx, dword ptr [ebp-30h]	8_2_02560608
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 4x nop then lea ecx, dword ptr [ebp-30h]	10_2_017F0608

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639713902.00000000056BE000.00000004.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639797895.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639860700.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comTC
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639713902.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comV
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639918482.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comcy5
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639900319.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comgne
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639918482.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comgy
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639713902.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comint
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639713902.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comlay
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639797895.00000000056BE000.00000004.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639991224.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comypo
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.640116720.00000000056BE000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comypooo
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.642010809.00000000056B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers&
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.642401940.00000000056B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.htmln
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.641965748.00000000056B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/k
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.642184941.00000000056B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers=
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.642184941.00000000056B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersQ
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.643199147.00000000056B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersb
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.642893460.00000000056B5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersr
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.643315337.0000000005684000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/mzN
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.643315337.0000000005684000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comFpz3
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.643315337.0000000005684000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comals
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.643315337.0000000005684000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comalsekz
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.676929479.0000000005680000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.676929479.0000000005680000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.commzN
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638167842.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comWh2
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638167842.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comX
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638167842.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comc
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638167842.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comi
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639259634.0000000005684000.00000004.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639244161.00000000056BD000.00000004.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639394139.0000000005684000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.639244161.00000000056BD000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn7
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.644178396.000000000568D000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.637926766.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com;
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.637926766.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.coma-d
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638866258.0000000005686000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krC
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638866258.0000000005686000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr~y8
Source: dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638355631.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comF
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638389150.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comFalMY~
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000003.638412498.000000000569B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comalMY~
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.677120512.0000000005960000.00000002.00000001.sdmp, 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.715867498.00000000059B0000.00000002.00000001.sdmp, dhcpmon.exe, 00000008.00000002.720166161.0000000004DB0000.00000002.00000001.sdmp, dhcpmon.exe, 0000000A.00000002.732352387.0000000005A00000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.907132131.0000000005980000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000002.741098736.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000002.719796822.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000002.742370218.0000000002FB1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.721387726.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000002.721168712.0000000004471000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000002.903845537.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.905880969.0000000004057000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.722411296.0000000004371000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6416, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6416, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 5748, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 5748, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 2460, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 2460, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6720, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6720, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6888, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6888, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 7160, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 7160, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6260, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: 256ec8f8f67b59c5e085b0bb63afcd13.exe PID: 6260, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 6500, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 6500, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.2fd3ac8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.3ffeab4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.3493a98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.405eab4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3c7ffe0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3c7ffe0.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.dhcpmon.exe.46f8490.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.46f8490.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.459ffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.459ffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.dhcpmon.exe.3d78490.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3d78490.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.dhcpmon.exe.43beab4.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.45fffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.45fffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4059c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.dhcpmon.exe.43c30dd.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5980000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.3ffeab4.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.40630dd.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.46f8490.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.dhcpmon.exe.46f8490.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.dhcpmon.exe.3393ac8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.4698490.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c20000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c30dd.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.3ff9c7e.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.3021680.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.5c24629.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3d78490.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3d78490.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.43cffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.43cffe0.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.40030dd.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44beab4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.43b9c7e.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.43b9c7e.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44b9c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.dhcpmon.exe.43beab4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.44c8490.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_052516DA NtQuerySystemInformation,		2_2_052516DA
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_0525169F NtQuerySystemInformation,		2_2_0525169F

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05479960	0_2_05479960
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05470878	0_2_05470878
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_054730D0	0_2_054730D0
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05472F1F	0_2_05472F1F
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05479950	0_2_05479950
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_054799F6	0_2_054799F6
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05474050	0_2_05474050
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05470868	0_2_05470868
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_054730C0	0_2_054730C0
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05475B17	0_2_05475B17
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05473E08	0_2_05473E08
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05473E18	0_2_05473E18
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_06DA06E5	0_2_06DA06E5
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_00C42050	0_2_00C42050
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_02AC0C8B	2_2_02AC0C8B
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_051289D8	2_2_051289D8
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_05123850	2_2_05123850
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_05122FA8	2_2_05122FA8
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_0512B238	2_2_0512B238
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_051295D8	2_2_051295D8
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_0512306F	2_2_0512306F
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_0512969F	2_2_0512969F
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_008F2050	2_2_008F2050
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C9960	7_2_055C9960
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C0878	7_2_055C0878
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C30D0	7_2_055C30D0
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C2F1F	7_2_055C2F1F
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C9950	7_2_055C9950
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C99F6	7_2_055C99F6
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C4050	7_2_055C4050
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C0868	7_2_055C0868
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C30C0	7_2_055C30C0
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C5B17	7_2_055C5B17
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C3E18	7_2_055C3E18
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C3E08	7_2_055C3E08
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_06CB06E5	7_2_06CB06E5
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_00DA2050	7_2_00DA2050
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02562F30	8_2_02562F30
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02560878	8_2_02560878
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_025630D0	8_2_025630D0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02569960	8_2_02569960
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02563E18	8_2_02563E18
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02563E08	8_2_02563E08
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02565B17	8_2_02565B17
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02564050	8_2_02564050
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02564060	8_2_02564060
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02560868	8_2_02560868
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_025630C0	8_2_025630C0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02569950	8_2_02569950
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_025699F6	8_2_025699F6
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_05EF06E5	8_2_05EF06E5
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_001C2050	8_2_001C2050
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F9960	10_2_017F9960
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F0878	10_2_017F0878
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F30D0	10_2_017F30D0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F2F30	10_2_017F2F30
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F9950	10_2_017F9950
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F99F6	10_2_017F99F6
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F0868	10_2_017F0868
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F4060	10_2_017F4060
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F4050	10_2_017F4050
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F30C0	10_2_017F30C0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F5B17	10_2_017F5B17
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F3E18	10_2_017F3E18
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F3E08	10_2_017F3E08
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_06B506E5	10_2_06B506E5
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_00DB2050	10_2_00DB2050
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 11_2_05633850	11_2_05633850
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 11_2_056323A0	11_2_056323A0
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 11_2_05632FA8	11_2_05632FA8
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 11_2_0563306F	11_2_0563306F
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 11_2_00E02050	11_2_00E02050

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe	Binary or memory string: OriginalFilename vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.680775118.0000000008940000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAssemblyReferenceEntry.exeD vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.680630357.00000000087D0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.680575404.0000000008770000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe	Binary or memory string: OriginalFilename vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.905334352.0000000003011000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907237424.0000000005C10000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.906613014.0000000005230000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907073740.0000000005920000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907264968.0000000005C20000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907733213.00000000064D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe	Binary or memory string: OriginalFilename vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.717914840.00000000082E0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAssemblyReferenceEntry.exeD vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.718049286.0000000008340000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.702880837.00000000014FA000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe	Binary or memory string: OriginalFilename vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 0000000B.00000002.722198116.0000000005750000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 0000000B.00000002.721168712.0000000004471000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs 256ec8f8f67b59c5e085b0bb63afcd13.exe
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe	Binary or memory string: OriginalFilename) vs 256ec8f8f67b59c5e085b0bb63afcd13.exe

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dhcpmon.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_0525149A AdjustTokenPrivileges,		2_2_0525149A
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_05251463 AdjustTokenPrivileges,		2_2_05251463

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6744:120:WilError_01
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6764:120:WilError_01
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{d1470c94-c693-4be3-b7c3-884d57fb2b86}

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll

Source: unknown	Process created: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe 'C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe'
Source: unknown	Process created: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe {path}
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp98F0.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpA082.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe 0
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: unknown	Process created: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe {path}
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process created: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp98F0.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpA082.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Process created: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe {path}	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}	Jump to behavior

Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 0_2_05477743 push ds; retf	0_2_0547774A
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_055C7743 push ds; retf	7_2_055C774A
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_06CB0440 push ss; retf	7_2_06CB0443
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_06CB0500 push ss; retf	7_2_06CB0503
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 7_2_06CB052C push ss; retf	7_2_06CB0530
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_02567743 push ds; retf	8_2_0256774A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_017F7743 push ds; retf	10_2_017F774A

Source: initial sample	Static PE information: section name: .text entropy: 7.95731162888
Source: initial sample	Static PE information: section name: .text entropy: 7.95731162888

Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 2.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 11.2.256ec8f8f67b59c5e085b0bb63afcd13.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 12.2.dhcpmon.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 5936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 6876	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 6876	Thread sleep count: 216 > 30	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 6876	Thread sleep count: 234 > 30	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 6648	Thread sleep count: 204 > 30	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 6872	Thread sleep time: -200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 4780	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 7136	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 6208	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe TID: 4864	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 7064	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5724	Thread sleep time: -922337203685477s >= -30000s

Analysis Report 256ec8f8f67b59c5e085b0bb63afcd13.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907733213.00000000064D0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907733213.00000000064D0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907733213.00000000064D0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000003.890425064.0000000006290000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.907733213.00000000064D0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Memory written: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Memory written: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.905453286.00000000030CF000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.904742882.0000000001590000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.904742882.0000000001590000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.904742882.0000000001590000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000000.00000002.676219646.00000000042A1000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.905334352.0000000003011000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000002.00000002.905334352.0000000003011000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 00000007.00000002.707013030.0000000004471000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000008.00000002.717514074.0000000003B51000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000A.00000002.730081391.00000000044D1000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 256ec8f8f67b59c5e085b0bb63afcd13.exe, 0000000B.00000002.721135661.0000000003471000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000C.00000002.722378411.0000000003371000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000E.00000002.742484463.0000000003FB1000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_05252906 bind,		2_2_05252906
Source: C:\Users\user\Desktop\256ec8f8f67b59c5e085b0bb63afcd13.exe	Code function: 2_2_052528E3 bind,		2_2_052528E3

ID:	355753
Product:	CloudBasic
Start time:	19:09:11
Start date:	21.02.2021
Sample:	256ec8f8f67b59c5e085b0bb63afcd13.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	0bbcc2e64e3edf053ed4af2c0bafb0eb
SHA1:	c006b8d2ec4b92f441815b20f1bdadf98eab1b4d
SHA256:	52d01903f7c366e01359a00ea771ca1f71d4e1bb54731290bc62c3a218f5af80
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Name	Type	MD5	SHA1	SHA256
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	0BBCC2E64E3EDF053ED4AF2C0BAFB0EB	C006B8D2EC4B92F441815B20F1BDADF98EAB1B4D	52D01903F7C366E01359A00EA771CA1F71D4E1BB54731290BC62C3A218F5AF80
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\256ec8f8f67b59c5e085b0bb63afcd13.exe.log	ASCII text, with CRLF line terminators	61CCF53571C9ABA6511D696CB0D32E45	A13A42A20EC14942F52DB20FB16A0A520F8183CE	3459BDF6C0B7F9D43649ADAAF19BA8D5D133BCBE5EF80CF4B7000DC91E10903B
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\dhcpmon.exe.log	ASCII text, with CRLF line terminators	61CCF53571C9ABA6511D696CB0D32E45	A13A42A20EC14942F52DB20FB16A0A520F8183CE	3459BDF6C0B7F9D43649ADAAF19BA8D5D133BCBE5EF80CF4B7000DC91E10903B
C:\Users\user\AppData\Local\Temp\tmp98F0.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	B78304EA0D7AFCCEFC8CFF617158D17C	76DD98BBFE885893DC19059C139EDCB829DFA21E	B80490FC583697FD68F2B7D0986C9F3BA3944BDB9AEA7F17C826E26BF1749C7F
C:\Users\user\AppData\Local\Temp\tmpA082.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	5C2F41CFC6F988C859DA7D727AC2B62A	68999C85FC7E37BAB9216E0099836D40D4545C1C	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat	Non-ISO extended-ASCII text, with no line terminators	5BF06D5C11AE13FC9970936540EB0703	54B778FC0BA984A04D47CB1E5C6E8252E9BE3FF9	39974C521C78E35079501265DF5A694586DAB94A7EE52F6E923756C5AFE5F3F0
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat	ASCII text, with no line terminators	90C08D85024FAD583545EC9562AA4A7E	FB6483F47BEC7ED49479D276986B4B789D9725AD	28D29127F67EA98D32833FAC5491366FEC57805EAFF2B15A8AB9AF2555EADCA3