Loading ...

Play interactive tourEdit tour

Analysis Report LIST OF POEA DELISTED AGENCIES.pdf.exe

Overview

General Information

Sample Name:LIST OF POEA DELISTED AGENCIES.pdf.exe
Analysis ID:383708
MD5:170934b168c75ed396332a6af365a478
SHA1:9089f509aae08997e6c8da1a33f3c5156a6f06bc
SHA256:1b7d2ae0faed1db793cfcf75e11cc0308c69af37540d27b9dbd104d0f850a658
Tags:exeNanoCoreRAT
Infos:

Most interesting Screenshot:

Detection

Nanocore
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected Nanocore Rat
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AntiVM3
Yara detected Nanocore RAT
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Startup

  • System is w10x64
  • LIST OF POEA DELISTED AGENCIES.pdf.exe (PID: 204 cmdline: 'C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe' MD5: 170934B168C75ED396332A6AF365A478)
    • schtasks.exe (PID: 804 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\lYcqUUrbhRC' /XML 'C:\Users\user\AppData\Local\Temp\tmp1EF7.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 5904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • LIST OF POEA DELISTED AGENCIES.pdf.exe (PID: 5592 cmdline: {path} MD5: 170934B168C75ED396332A6AF365A478)
      • schtasks.exe (PID: 6240 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpB457.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
        • conhost.exe (PID: 6248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • LIST OF POEA DELISTED AGENCIES.pdf.exe (PID: 6380 cmdline: 'C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe' 0 MD5: 170934B168C75ED396332A6AF365A478)
    • schtasks.exe (PID: 6672 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\lYcqUUrbhRC' /XML 'C:\Users\user\AppData\Local\Temp\tmp5375.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 6756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "a8eeb35c-017d-4116-8f99-efe29258", "Group": "uuu", "Domain1": "shahzad73.casacam.net", "Domain2": "shahzad73.ddns.net", "Port": 9036, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo />\r\n  <Triggers />\r\n  <Principals>\r\n    <Principal id=\"Author\">\r\n      <LogonType>InteractiveToken</LogonType>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <StartWhenAvailable>false</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>false</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>4</Priority>\r\n  </Settings>\r\n  <Actions Context=\"Author\">\r\n    <Exec>\r\n      <Command>\"#EXECUTABLEPATH\"</Command>\r\n      <Arguments>$(Arg0)</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000007.00000002.504910894.0000000005340000.00000004.00000001.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
  • 0xe75:$x1: NanoCore.ClientPluginHost
  • 0xe8f:$x2: IClientNetworkHost
00000007.00000002.504910894.0000000005340000.00000004.00000001.sdmpNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth
  • 0xe75:$x2: NanoCore.ClientPluginHost
  • 0x1261:$s3: PipeExists
  • 0x1136:$s4: PipeCreated
  • 0xeb0:$s5: IClientLoggingHost
00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmpJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
    00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmpNanoCoreunknown Kevin Breen <kevin@techanarchy.net>
    • 0x435b5:$a: NanoCore
    • 0x4360e:$a: NanoCore
    • 0x4364b:$a: NanoCore
    • 0x436c4:$a: NanoCore
    • 0x56d6f:$a: NanoCore
    • 0x56d84:$a: NanoCore
    • 0x56db9:$a: NanoCore
    • 0x6fd5b:$a: NanoCore
    • 0x6fd70:$a: NanoCore
    • 0x6fda5:$a: NanoCore
    • 0x43617:$b: ClientPlugin
    • 0x43654:$b: ClientPlugin
    • 0x43f52:$b: ClientPlugin
    • 0x43f5f:$b: ClientPlugin
    • 0x56b2b:$b: ClientPlugin
    • 0x56b46:$b: ClientPlugin
    • 0x56b76:$b: ClientPlugin
    • 0x56d8d:$b: ClientPlugin
    • 0x56dc2:$b: ClientPlugin
    • 0x6fb17:$b: ClientPlugin
    • 0x6fb32:$b: ClientPlugin
    00000007.00000002.505287922.0000000005780000.00000004.00000001.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
    • 0xf7ad:$x1: NanoCore.ClientPluginHost
    • 0xf7da:$x2: IClientNetworkHost
    Click to see the 57 entries

    Unpacked PEs

    SourceRuleDescriptionAuthorStrings
    7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.unpackNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
    • 0xd9ad:$x1: NanoCore.ClientPluginHost
    • 0xd9da:$x2: IClientNetworkHost
    7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.unpackNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth
    • 0xd9ad:$x2: NanoCore.ClientPluginHost
    • 0xea88:$s4: PipeCreated
    • 0xd9c7:$s5: IClientLoggingHost
    7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.unpackJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
      7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2eb60d8.3.unpackNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
      • 0x2dbb:$x1: NanoCore.ClientPluginHost
      • 0x2de5:$x2: IClientNetworkHost
      7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2eb60d8.3.unpackNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth
      • 0x2dbb:$x2: NanoCore.ClientPluginHost
      • 0x4c6b:$s4: PipeCreated
      Click to see the 157 entries

      Sigma Overview

      System Summary:

      barindex
      Sigma detected: NanoCoreShow sources
      Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe, ProcessId: 5592, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
      Sigma detected: Scheduled temp file as task from temp locationShow sources
      Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\lYcqUUrbhRC' /XML 'C:\Users\user\AppData\Local\Temp\tmp1EF7.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\lYcqUUrbhRC' /XML 'C:\Users\user\AppData\Local\Temp\tmp1EF7.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe' , ParentImage: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe, ParentProcessId: 204, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\lYcqUUrbhRC' /XML 'C:\Users\user\AppData\Local\Temp\tmp1EF7.tmp', ProcessId: 804

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Found malware configurationShow sources
      Source: 00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmpMalware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "a8eeb35c-017d-4116-8f99-efe29258", "Group": "uuu", "Domain1": "shahzad73.casacam.net", "Domain2": "shahzad73.ddns.net", "Port": 9036, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}
      Multi AV Scanner detection for domain / URLShow sources
      Source: shahzad73.casacam.netVirustotal: Detection: 5%Perma Link
      Source: shahzad73.ddns.netVirustotal: Detection: 5%Perma Link
      Yara detected Nanocore RATShow sources
      Source: Yara matchFile source: 00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.505287922.0000000005780000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 0000000B.00000002.294311257.0000000003869000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.497876017.0000000002DE1000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000013.00000002.308929356.0000000000402000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.493270074.0000000000402000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.501964198.0000000003F3F000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000013.00000002.309746032.0000000003421000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.502093667.0000000003FEF000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.259633262.00000000038F9000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 6836, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 5592, type: MEMORY
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.447060c.4.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff8b69.12.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.447060c.4.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5784629.21.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.446b7d6.5.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a91678.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff4540.13.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.4474c35.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3de9930.8.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a01678.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fef70a.14.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff4540.13.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3dee5cf.7.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3df81d4.6.raw.unpack, type: UNPACKEDPE
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.unpackAvira: Label: TR/NanoCore.fadte
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpackAvira: Label: TR/Dropper.MSIL.Gen7
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpackAvira: Label: TR/Dropper.MSIL.Gen7
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
      Source: Binary string: mscorlib.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.496438709.00000000010B1000.00000004.00000020.sdmp
      Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\MyNanoCore RemoteScripting\MyClientPlugin\obj\Debug\MyClientPluginNew.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp
      Source: Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp
      Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp
      Source: Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp
      Source: Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp
      Source: Binary string: System.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.496453715.00000000010B4000.00000004.00000020.sdmp
      Source: Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 4x nop then lea esp, dword ptr [ebp-04h]

      Networking:

      barindex
      Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49705 -> 79.134.225.9:9036
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49706 -> 79.134.225.9:9036
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49708 -> 79.134.225.9:9036
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49712 -> 79.134.225.9:9036
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49718 -> 79.134.225.9:9036
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49720 -> 79.134.225.9:9036
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49721 -> 79.134.225.9:9036
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49724 -> 79.134.225.9:9036
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49730 -> 79.134.225.9:9036
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49731 -> 79.134.225.9:9036
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49732 -> 79.134.225.9:9036
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49733 -> 79.134.225.9:9036
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49736 -> 79.134.225.9:9036
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49737 -> 79.134.225.9:9036
      Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49738 -> 79.134.225.9:9036
      C2 URLs / IPs found in malware configurationShow sources
      Source: Malware configuration extractorURLs: shahzad73.ddns.net
      Source: Malware configuration extractorURLs: shahzad73.casacam.net
      Source: global trafficTCP traffic: 192.168.2.5:49705 -> 79.134.225.9:9036
      Source: Joe Sandbox ViewIP Address: 79.134.225.9 79.134.225.9
      Source: Joe Sandbox ViewASN Name: FINK-TELECOM-SERVICESCH FINK-TELECOM-SERVICESCH
      Source: unknownDNS traffic detected: queries for: shahzad73.casacam.net
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpString found in binary or memory: http://google.com
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.270340865.0000000007421000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300872246.0000000006FD1000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.258728477.0000000000A17000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.coma
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.258728477.0000000000A17000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comrY.
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.258728477.0000000000A17000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comueva
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exeString found in binary or memory: https://github.com/michel-pi/EasyBot.Net
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: RegisterRawInputDevices

      E-Banking Fraud:

      barindex
      Yara detected Nanocore RATShow sources
      Source: Yara matchFile source: 00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.505287922.0000000005780000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 0000000B.00000002.294311257.0000000003869000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.497876017.0000000002DE1000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000013.00000002.308929356.0000000000402000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.493270074.0000000000402000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.501964198.0000000003F3F000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000013.00000002.309746032.0000000003421000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.502093667.0000000003FEF000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.259633262.00000000038F9000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 6836, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 5592, type: MEMORY
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.447060c.4.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff8b69.12.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.447060c.4.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5784629.21.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.446b7d6.5.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a91678.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff4540.13.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.4474c35.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3de9930.8.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a01678.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fef70a.14.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff4540.13.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3dee5cf.7.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3df81d4.6.raw.unpack, type: UNPACKEDPE

      System Summary:

      barindex
      Malicious sample detected (through community Yara rule)Show sources
      Source: 00000007.00000002.504910894.0000000005340000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000007.00000002.505287922.0000000005780000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000007.00000002.505774970.0000000006620000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 0000000B.00000002.294311257.0000000003869000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 0000000B.00000002.294311257.0000000003869000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000007.00000002.505788129.0000000006630000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000007.00000002.505834895.0000000006670000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000007.00000002.505731790.00000000065F0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000007.00000002.505705551.00000000065D0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000007.00000002.505744453.0000000006600000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000007.00000002.505679942.00000000065B0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000007.00000002.502325933.00000000040DD000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000007.00000002.505693803.00000000065C0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000007.00000002.505618683.0000000006560000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000007.00000002.505717572.00000000065E0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000013.00000002.308929356.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000013.00000002.308929356.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000007.00000002.493270074.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000007.00000002.493270074.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000007.00000002.505218094.0000000005550000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000007.00000002.501964198.0000000003F3F000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000007.00000002.505667640.00000000065A0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000013.00000002.309746032.0000000003421000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000007.00000002.502093667.0000000003FEF000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000000.00000002.259633262.00000000038F9000.00000004.00000001.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 00000000.00000002.259633262.00000000038F9000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 00000007.00000002.498112941.0000000002E4C000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 6836, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 6836, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 5592, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 5592, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2eb60d8.3.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65c0000.28.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65d0000.29.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65f0000.31.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.345c48c.2.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fa365e.9.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65b0000.27.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6600000.32.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65f0000.31.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3de9930.8.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41e83f7.16.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41e83f7.16.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fb7c89.10.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.447060c.4.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.447060c.4.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff8b69.12.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65e0000.30.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6630000.35.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fb7c89.10.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff8b69.12.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41ff656.15.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2eb60d8.3.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2eb60d8.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2ed69e4.5.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2ed69e4.5.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.663e8a4.34.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6670000.37.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6620000.33.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6560000.25.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41f1226.17.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65b0000.27.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5784629.21.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65d0000.29.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2ec2364.4.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41e83f7.16.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fa365e.9.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fa365e.9.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.446b7d6.5.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.446b7d6.5.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5550000.20.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6670000.37.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65e0000.30.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41ff656.15.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6600000.32.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2e0ca0c.2.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6560000.25.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a91678.3.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a91678.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5550000.20.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65a0000.26.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3f9742c.11.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3f9742c.11.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff4540.13.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6620000.33.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6634c9f.36.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5340000.19.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3f9742c.11.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6630000.35.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.4474c35.3.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3de9930.8.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41f1226.17.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a01678.3.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a01678.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fef70a.14.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fef70a.14.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2ec2364.4.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2ec2364.4.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff4540.13.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff4540.13.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3dee5cf.7.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3df81d4.6.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
      Initial sample is a PE file and has a suspicious nameShow sources
      Source: initial sampleStatic PE information: Filename: LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02770B70
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02775770
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_027787ED
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_027767C8
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02776568
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02774D98
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02776230
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02776221
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02770AD0
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02772370
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02772361
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02775B60
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02775B50
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02770040
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02775038
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_0277502B
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02770007
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_027720C0
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_027720B9
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02778958
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02775763
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_027767B8
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02773C30
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02773C1F
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02776558
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_02774D88
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_028DC204
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_028DE627
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_028DE630
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 7_2_0100E471
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 7_2_0100E480
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 7_2_0100BBD4
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 7_2_0526F5F8
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 7_2_05269788
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 7_2_0526A610
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 7_2_066D0040
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 7_2_066D9D18
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 7_2_066D8DC8
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 7_2_066D9A9E
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 7_2_066D99E0
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_0263C204
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_0263E623
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_0263E630
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C56E8
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C6740
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C64E0
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C0B70
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C4D98
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C2370
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C0040
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C502A
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C5038
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C0007
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C20C0
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C61A8
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C619A
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C5AC8
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C5AD8
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C3C30
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026C4D88
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_04D50128
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_04D56668
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_04D50123
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_0528E7D8
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_0528DC34
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_05280448
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_0528A167
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_0528A1A0
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_0528F368
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_05280B60
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_05285A80
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 19_2_0193E480
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 19_2_0193E471
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 19_2_0193BBD4
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 19_2_059DF5F8
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 19_2_059D9788
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 19_2_059DA5E1
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 19_2_059DA602
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.270268219.0000000007380000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.259547277.00000000028F1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMetroFramework.dll> vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.268983784.00000000070B0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMajorRevision.exe< vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.258333307.00000000004BC000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameJ( vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.270934585.000000000F170000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.494394647.00000000009DC000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameJ( vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.496068357.000000000101A000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.505774970.0000000006620000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSecurityClientPlugin.dll4 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameAForge.Video.DirectShow.dll4 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNAudio.dll4 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSurveillanceClientPlugin.dll4 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameClientPlugin.dll4 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameLzma#.dll4 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameCoreClientPlugin.dll8 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameManagementClientPlugin.dll4 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNanoCoreBase.dll< vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMyClientPluginNew.dll4 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll4 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameFileBrowserClient.dllT vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll@ vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNanoCoreStressTester.dll< vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNetworkClientPlugin.dll4 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameToolsClientPlugin.dll4 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.506146009.00000000071E0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.505486753.0000000006230000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300582699.0000000006CD0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMajorRevision.exe< vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.289207075.00000000004EC000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameJ( vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300678472.0000000006D90000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300766167.0000000006E40000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMetroFramework.dll> vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300496064.0000000006910000.00000002.00000001.sdmpBinary or memory string: originalfilename vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300496064.0000000006910000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.302055679.0000000009350000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameClientPlugin.dll4 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameLzma#.dll4 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000013.00000000.287148486.000000000107C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameJ( vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exeBinary or memory string: OriginalFilenameJ( vs LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
      Source: 00000007.00000002.504910894.0000000005340000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000007.00000002.504910894.0000000005340000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000007.00000002.505287922.0000000005780000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000007.00000002.505287922.0000000005780000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000007.00000002.505774970.0000000006620000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000007.00000002.505774970.0000000006620000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 0000000B.00000002.294311257.0000000003869000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 0000000B.00000002.294311257.0000000003869000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000007.00000002.505788129.0000000006630000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000007.00000002.505788129.0000000006630000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000007.00000002.505834895.0000000006670000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000007.00000002.505834895.0000000006670000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000007.00000002.505731790.00000000065F0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000007.00000002.505731790.00000000065F0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000007.00000002.505705551.00000000065D0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000007.00000002.505705551.00000000065D0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000007.00000002.505744453.0000000006600000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000007.00000002.505744453.0000000006600000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000007.00000002.505679942.00000000065B0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000007.00000002.505679942.00000000065B0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000007.00000002.502325933.00000000040DD000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000007.00000002.505693803.00000000065C0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000007.00000002.505693803.00000000065C0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000007.00000002.505618683.0000000006560000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000007.00000002.505618683.0000000006560000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000007.00000002.505717572.00000000065E0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000007.00000002.505717572.00000000065E0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000013.00000002.308929356.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000013.00000002.308929356.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000007.00000002.493270074.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000007.00000002.493270074.0000000000402000.00000040.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000007.00000002.505218094.0000000005550000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000007.00000002.505218094.0000000005550000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000007.00000002.501964198.0000000003F3F000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000007.00000002.505667640.00000000065A0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000007.00000002.505667640.00000000065A0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000013.00000002.309746032.0000000003421000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000007.00000002.502093667.0000000003FEF000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000000.00000002.259633262.00000000038F9000.00000004.00000001.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 00000000.00000002.259633262.00000000038F9000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 00000007.00000002.498112941.0000000002E4C000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 6836, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 6836, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 5592, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 5592, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2eb60d8.3.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2eb60d8.3.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65c0000.28.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65c0000.28.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65d0000.29.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65d0000.29.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65f0000.31.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65f0000.31.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.345c48c.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.345c48c.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fa365e.9.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fa365e.9.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65b0000.27.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65b0000.27.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6600000.32.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6600000.32.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65f0000.31.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65f0000.31.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3de9930.8.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3de9930.8.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41e83f7.16.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41e83f7.16.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41e83f7.16.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fb7c89.10.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fb7c89.10.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.447060c.4.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.447060c.4.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.447060c.4.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.447060c.4.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff8b69.12.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65e0000.30.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6630000.35.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6630000.35.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65e0000.30.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fb7c89.10.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff8b69.12.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41ff656.15.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41ff656.15.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2eb60d8.3.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2eb60d8.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2ed69e4.5.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2ed69e4.5.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.663e8a4.34.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.663e8a4.34.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6670000.37.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6670000.37.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6620000.33.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6620000.33.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6560000.25.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6560000.25.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41f1226.17.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41f1226.17.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65b0000.27.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65b0000.27.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5784629.21.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5784629.21.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65d0000.29.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65d0000.29.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2ec2364.4.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2ec2364.4.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41e83f7.16.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41e83f7.16.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fa365e.9.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fa365e.9.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fa365e.9.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.446b7d6.5.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.446b7d6.5.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.446b7d6.5.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5550000.20.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5550000.20.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6670000.37.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6670000.37.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65e0000.30.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65e0000.30.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41ff656.15.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41ff656.15.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6600000.32.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6600000.32.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2e0ca0c.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2e0ca0c.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6560000.25.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6560000.25.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a91678.3.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a91678.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5550000.20.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5550000.20.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65a0000.26.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.65a0000.26.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3f9742c.11.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3f9742c.11.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3f9742c.11.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff4540.13.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff4540.13.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6620000.33.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6620000.33.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6634c9f.36.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6634c9f.36.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5340000.19.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5340000.19.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3f9742c.11.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3f9742c.11.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6630000.35.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.6630000.35.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.4474c35.3.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.4474c35.3.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3de9930.8.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41f1226.17.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.41f1226.17.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a01678.3.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a01678.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fef70a.14.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fef70a.14.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2ec2364.4.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.2ec2364.4.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff4540.13.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff4540.13.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3dee5cf.7.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3df81d4.6.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: lYcqUUrbhRC.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.csCryptographic APIs: 'CreateDecryptor'
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.csCryptographic APIs: 'TransformFinalBlock'
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.csCryptographic APIs: 'CreateDecryptor'
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.csCryptographic APIs: 'TransformFinalBlock'
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.csSecurity API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
      Source: classification engineClassification label: mal100.troj.evad.winEXE@15/8@15/1
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeFile created: C:\Users\user\AppData\Roaming\lYcqUUrbhRC.exeJump to behavior
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{a8eeb35c-017d-4116-8f99-efe2925862de}
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeMutant created: \Sessions\1\BaseNamedObjects\UFQVOTY
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6248:120:WilError_01
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5904:120:WilError_01
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6756:120:WilError_01
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeFile created: C:\Users\user\AppData\Local\Temp\tmp1EF7.tmpJump to behavior
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeFile read: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe 'C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe'
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\lYcqUUrbhRC' /XML 'C:\Users\user\AppData\Local\Temp\tmp1EF7.tmp'
      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe {path}
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpB457.tmp'
      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: unknownProcess created: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe 'C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe' 0
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\lYcqUUrbhRC' /XML 'C:\Users\user\AppData\Local\Temp\tmp5375.tmp'
      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe {path}
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\lYcqUUrbhRC' /XML 'C:\Users\user\AppData\Local\Temp\tmp1EF7.tmp'
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe {path}
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpB457.tmp'
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\lYcqUUrbhRC' /XML 'C:\Users\user\AppData\Local\Temp\tmp5375.tmp'
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe {path}
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
      Source: Binary string: mscorlib.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.496438709.00000000010B1000.00000004.00000020.sdmp
      Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\MyNanoCore RemoteScripting\MyClientPlugin\obj\Debug\MyClientPluginNew.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp
      Source: Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp
      Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp
      Source: Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp
      Source: Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp
      Source: Binary string: System.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.496453715.00000000010B4000.00000004.00000020.sdmp
      Source: Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp

      Data Obfuscation:

      barindex
      .NET source code contains method to dynamically call methods (often used by packers)Show sources
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, ImageManager/Main.cs.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
      Source: lYcqUUrbhRC.exe.0.dr, ImageManager/Main.cs.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, ImageManager/Main.cs.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
      Source: 0.0.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, ImageManager/Main.cs.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
      Source: 7.0.LIST OF POEA DELISTED AGENCIES.pdf.exe.920000.0.unpack, ImageManager/Main.cs.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.920000.1.unpack, ImageManager/Main.cs.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.430000.0.unpack, ImageManager/Main.cs.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
      Source: 11.0.LIST OF POEA DELISTED AGENCIES.pdf.exe.430000.0.unpack, ImageManager/Main.cs.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
      Source: 19.0.LIST OF POEA DELISTED AGENCIES.pdf.exe.fc0000.0.unpack, ImageManager/Main.cs.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.fc0000.1.unpack, ImageManager/Main.cs.Net Code: LateBinding.LateCall(V_6, null, "Invoke", new object[] { 0, V_0 }, null, null)
      .NET source code contains potential unpackerShow sources
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_0277BAA5 push FFFFFF8Bh; iretd
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_028D4219 push ebp; retf 0004h
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_028D40C0 push ecx; retf 0004h
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_028D4490 push edi; retf 0004h
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_028D4442 push edi; retf 0004h
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_028DB2B9 pushfd ; retf 0004h
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_028DB220 pushfd ; retf 0004h
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_028DB250 pushfd ; retf 0004h
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_028DB30F pushfd ; retf 0004h
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_028DB191 pushfd ; retf 0004h
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 0_2_028DB1F1 pushfd ; retf 0004h
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 7_2_052669F8 pushad ; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 7_2_066DD22B push ecx; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 7_2_066DBFE0 pushad ; ret
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_02634219 push ebp; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026342D3 push edi; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026342D0 push edi; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026342D7 push edi; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026340C3 push ecx; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026340C0 push ecx; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_02634123 push ecx; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_02634120 push ecx; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_02634127 push ecx; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_026341E3 push esp; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_02634442 push edi; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_0263444B push edi; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_02634493 push edi; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_02634490 push edi; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_0263B250 pushfd ; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_0263B30F pushfd ; retf
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeCode function: 11_2_0263B313 pushfd ; retf
      Source: initial sampleStatic PE information: section name: .text entropy: 7.90065645819
      Source: initial sampleStatic PE information: section name: .text entropy: 7.90065645819
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.csHigh entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.csHigh entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.csHigh entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.csHigh entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeFile created: C:\Users\user\AppData\Roaming\lYcqUUrbhRC.exeJump to dropped file

      Boot Survival:

      barindex
      Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\lYcqUUrbhRC' /XML 'C:\Users\user\AppData\Local\Temp\tmp1EF7.tmp'

      Hooking and other Techniques for Hiding and Protection:

      barindex
      Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeFile opened: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe:Zone.Identifier read attributes | delete
      Uses an obfuscated file name to hide its real file extension (double extension)Show sources
      Source: Possible double extension: pdf.exeStatic PE information: LIST OF POEA DELISTED AGENCIES.pdf.exe
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information set: NOOPENFILEERRORBOX

      Malware Analysis System Evasion:

      barindex
      Yara detected AntiVM3Show sources
      Source: Yara matchFile source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 6380, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 204, type: MEMORY
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.270340865.0000000007421000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300872246.0000000006FD1000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.270340865.0000000007421000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300872246.0000000006FD1000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeWindow / User API: threadDelayed 4781
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeWindow / User API: threadDelayed 4574
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeWindow / User API: foregroundWindowGot 888
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe TID: 3952Thread sleep time: -31500s >= -30000s
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe TID: 5088Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe TID: 6308Thread sleep time: -11068046444225724s >= -30000s
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe TID: 6384Thread sleep time: -31500s >= -30000s
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe TID: 6408Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe TID: 6924Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeThread delayed: delay time: 31500
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeThread delayed: delay time: 31500
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeThread delayed: delay time: 922337203685477
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300872246.0000000006FD1000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.506146009.00000000071E0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300872246.0000000006FD1000.00000004.00000001.sdmpBinary or memory string: vmware
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300872246.0000000006FD1000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300872246.0000000006FD1000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300872246.0000000006FD1000.00000004.00000001.sdmpBinary or memory string: VMWARE
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300872246.0000000006FD1000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.506146009.00000000071E0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.506146009.00000000071E0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300872246.0000000006FD1000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300872246.0000000006FD1000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300872246.0000000006FD1000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.496471580.00000000010BE000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.506146009.00000000071E0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess information queried: ProcessInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess token adjusted: Debug
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess token adjusted: Debug
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess token adjusted: Debug
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeMemory allocated: page read and write | page guard

      HIPS / PFW / Operating System Protection Evasion:

      barindex
      .NET source code references suspicious native API functionsShow sources
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, ImageManager/PInvoke/WinApi.csReference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')
      Source: lYcqUUrbhRC.exe.0.dr, ImageManager/PInvoke/WinApi.csReference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')
      Source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, ImageManager/PInvoke/WinApi.csReference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')
      Source: 0.0.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, ImageManager/PInvoke/WinApi.csReference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')
      Source: 7.0.LIST OF POEA DELISTED AGENCIES.pdf.exe.920000.0.unpack, ImageManager/PInvoke/WinApi.csReference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.920000.1.unpack, ImageManager/PInvoke/WinApi.csReference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')
      Source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqjryTBW16mUfo_ItH9KWoGQu003du003d.csReference to suspicious API methods: ('#=qxG$Aklpbf6gyBfAqTMmORA==', 'OpenProcess@kernel32.dll'), ('#=qh7diH14jww3Fm9rMJ_jIfQ==', 'FindResourceEx@kernel32.dll')
      Source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.430000.0.unpack, ImageManager/PInvoke/WinApi.csReference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')
      Source: 11.0.LIST OF POEA DELISTED AGENCIES.pdf.exe.430000.0.unpack, ImageManager/PInvoke/WinApi.csReference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, u0023u003dqjryTBW16mUfo_ItH9KWoGQu003du003d.csReference to suspicious API methods: ('#=qxG$Aklpbf6gyBfAqTMmORA==', 'OpenProcess@kernel32.dll'), ('#=qh7diH14jww3Fm9rMJ_jIfQ==', 'FindResourceEx@kernel32.dll')
      Source: 19.0.LIST OF POEA DELISTED AGENCIES.pdf.exe.fc0000.0.unpack, ImageManager/PInvoke/WinApi.csReference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')
      Source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.fc0000.1.unpack, ImageManager/PInvoke/WinApi.csReference to suspicious API methods: ('InternalLoadLibraryW', 'LoadLibraryW@kernel32.dll'), ('InternalGetProcAddress', 'GetProcAddress@kernel32.dll')
      Injects a PE file into a foreign processesShow sources
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeMemory written: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe base: 400000 value starts with: 4D5A
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeMemory written: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe base: 400000 value starts with: 4D5A
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\lYcqUUrbhRC' /XML 'C:\Users\user\AppData\Local\Temp\tmp1EF7.tmp'
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe {path}
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpB457.tmp'
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\lYcqUUrbhRC' /XML 'C:\Users\user\AppData\Local\Temp\tmp5375.tmp'
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeProcess created: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe {path}
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.505469950.000000000622D000.00000004.00000001.sdmpBinary or memory string: Program Manager
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.497349750.00000000017D0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.497349750.00000000017D0000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.497349750.00000000017D0000.00000002.00000001.sdmpBinary or memory string: SProgram Managerl
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501627661.0000000003217000.00000004.00000001.sdmpBinary or memory string: Program Manager4af
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.505989014.0000000006A9D000.00000004.00000010.sdmpBinary or memory string: Program Manager H
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.497349750.00000000017D0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd,
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.497349750.00000000017D0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501293148.0000000003185000.00000004.00000001.sdmpBinary or memory string: Program Manager`
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.498112941.0000000002E4C000.00000004.00000001.sdmpBinary or memory string: Program Manager
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
      Source: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

      Stealing of Sensitive Information:

      barindex
      Yara detected Nanocore RATShow sources
      Source: Yara matchFile source: 00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.505287922.0000000005780000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 0000000B.00000002.294311257.0000000003869000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.497876017.0000000002DE1000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000013.00000002.308929356.0000000000402000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.493270074.0000000000402000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.501964198.0000000003F3F000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000013.00000002.309746032.0000000003421000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.502093667.0000000003FEF000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.259633262.00000000038F9000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 6836, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 5592, type: MEMORY
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.447060c.4.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff8b69.12.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.447060c.4.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5784629.21.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.446b7d6.5.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a91678.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff4540.13.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.4474c35.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3de9930.8.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a01678.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fef70a.14.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff4540.13.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3dee5cf.7.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3df81d4.6.raw.unpack, type: UNPACKEDPE

      Remote Access Functionality:

      barindex
      Detected Nanocore RatShow sources
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.505774970.0000000006620000.00000004.00000001.sdmpString found in binary or memory: NanoCore.ClientPluginHost
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmpString found in binary or memory: NanoCore.ClientPluginHost
      Source: LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
      Yara detected Nanocore RATShow sources
      Source: Yara matchFile source: 00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.505287922.0000000005780000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 0000000B.00000002.294311257.0000000003869000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.497876017.0000000002DE1000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000013.00000002.308929356.0000000000402000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.493270074.0000000000402000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.501964198.0000000003F3F000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000013.00000002.309746032.0000000003421000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000007.00000002.502093667.0000000003FEF000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.259633262.00000000038F9000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 6836, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: LIST OF POEA DELISTED AGENCIES.pdf.exe PID: 5592, type: MEMORY
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.447060c.4.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff8b69.12.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.447060c.4.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5784629.21.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.446b7d6.5.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a91678.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 0.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3b44498.2.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff4540.13.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.4474c35.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ae70c8.2.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3de9930.8.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 11.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3a01678.3.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3fef70a.14.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3ff4540.13.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3dee5cf.7.raw.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.3df81d4.6.raw.unpack, type: UNPACKEDPE

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsScheduled Task/Job1Scheduled Task/Job1Process Injection112Masquerading11Input Capture11Security Software Discovery111Remote ServicesInput Capture11Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsNative API1Boot or Logon Initialization ScriptsScheduled Task/Job1Disable or Modify Tools1LSASS MemoryProcess Discovery2Remote Desktop ProtocolArchive Collected Data11Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion31Security Account ManagerVirtualization/Sandbox Evasion31SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationRemote Access Software1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection112NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferNon-Application Layer Protocol1SIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsFile and Directory Discovery1SSHKeyloggingData Transfer Size LimitsApplication Layer Protocol11Manipulate Device CommunicationManipulate App Store Rankings or Ratings
      Replication Through Removable MediaLaunchdRc.commonRc.commonHidden Files and Directories1Cached Domain CredentialsSystem Information Discovery12VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsObfuscated Files or Information13DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobSoftware Packing23Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 signatures2 2 Behavior Graph ID: 383708 Sample: LIST OF POEA DELISTED AGENC... Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 43 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->43 45 Multi AV Scanner detection for domain / URL 2->45 47 Found malware configuration 2->47 49 14 other signatures 2->49 8 LIST OF POEA DELISTED AGENCIES.pdf.exe 6 2->8         started        12 LIST OF POEA DELISTED AGENCIES.pdf.exe 4 2->12         started        process3 file4 33 C:\Users\user\AppData\Local\...\tmp1EF7.tmp, XML 8->33 dropped 35 C:\Users\user\AppData\...\lYcqUUrbhRC.exe, PE32 8->35 dropped 51 Injects a PE file into a foreign processes 8->51 14 LIST OF POEA DELISTED AGENCIES.pdf.exe 9 8->14         started        19 schtasks.exe 1 8->19         started        21 schtasks.exe 1 12->21         started        23 LIST OF POEA DELISTED AGENCIES.pdf.exe 2 12->23         started        signatures5 process6 dnsIp7 39 shahzad73.casacam.net 79.134.225.9, 49705, 49706, 49708 FINK-TELECOM-SERVICESCH Switzerland 14->39 37 C:\Users\user\AppData\Roaming\...\run.dat, Non-ISO 14->37 dropped 41 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->41 25 schtasks.exe 1 14->25         started        27 conhost.exe 19->27         started        29 conhost.exe 21->29         started        file8 signatures9 process10 process11 31 conhost.exe 25->31         started       

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      No Antivirus matches

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      SourceDetectionScannerLabelLinkDownload
      7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.5780000.22.unpack100%AviraTR/NanoCore.fadteDownload File
      19.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack100%AviraTR/Dropper.MSIL.Gen7Download File
      7.2.LIST OF POEA DELISTED AGENCIES.pdf.exe.400000.0.unpack100%AviraTR/Dropper.MSIL.Gen7Download File

      Domains

      SourceDetectionScannerLabelLink
      shahzad73.casacam.net6%VirustotalBrowse

      URLs

      SourceDetectionScannerLabelLink
      shahzad73.ddns.net6%VirustotalBrowse
      shahzad73.ddns.net0%Avira URL Cloudsafe
      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
      http://www.fontbureau.comueva0%Avira URL Cloudsafe
      http://www.tiro.com0%URL Reputationsafe
      http://www.tiro.com0%URL Reputationsafe
      http://www.tiro.com0%URL Reputationsafe
      http://www.tiro.com0%URL Reputationsafe
      http://www.goodfont.co.kr0%URL Reputationsafe
      http://www.goodfont.co.kr0%URL Reputationsafe
      http://www.goodfont.co.kr0%URL Reputationsafe
      http://www.goodfont.co.kr0%URL Reputationsafe
      http://www.fontbureau.coma0%URL Reputationsafe
      http://www.fontbureau.coma0%URL Reputationsafe
      http://www.fontbureau.coma0%URL Reputationsafe
      http://www.fontbureau.coma0%URL Reputationsafe
      http://www.carterandcone.coml0%URL Reputationsafe
      http://www.carterandcone.coml0%URL Reputationsafe
      http://www.carterandcone.coml0%URL Reputationsafe
      http://www.carterandcone.coml0%URL Reputationsafe
      http://www.sajatypeworks.com0%URL Reputationsafe
      http://www.sajatypeworks.com0%URL Reputationsafe
      http://www.sajatypeworks.com0%URL Reputationsafe
      http://www.sajatypeworks.com0%URL Reputationsafe
      http://www.typography.netD0%URL Reputationsafe
      http://www.typography.netD0%URL Reputationsafe
      http://www.typography.netD0%URL Reputationsafe
      http://www.typography.netD0%URL Reputationsafe
      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
      http://fontfabrik.com0%URL Reputationsafe
      http://fontfabrik.com0%URL Reputationsafe
      http://fontfabrik.com0%URL Reputationsafe
      http://fontfabrik.com0%URL Reputationsafe
      http://www.founder.com.cn/cn0%URL Reputationsafe
      http://www.founder.com.cn/cn0%URL Reputationsafe
      http://www.founder.com.cn/cn0%URL Reputationsafe
      http://www.founder.com.cn/cn0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
      http://www.sandoll.co.kr0%URL Reputationsafe
      http://www.sandoll.co.kr0%URL Reputationsafe
      http://www.sandoll.co.kr0%URL Reputationsafe
      http://www.sandoll.co.kr0%URL Reputationsafe
      http://www.fontbureau.comrY.0%Avira URL Cloudsafe
      http://www.urwpp.deDPlease0%URL Reputationsafe
      http://www.urwpp.deDPlease0%URL Reputationsafe
      http://www.urwpp.deDPlease0%URL Reputationsafe
      http://www.zhongyicts.com.cn0%URL Reputationsafe
      http://www.zhongyicts.com.cn0%URL Reputationsafe
      http://www.zhongyicts.com.cn0%URL Reputationsafe
      http://www.sakkal.com0%URL Reputationsafe
      http://www.sakkal.com0%URL Reputationsafe
      http://www.sakkal.com0%URL Reputationsafe
      shahzad73.casacam.net0%Avira URL Cloudsafe

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      shahzad73.casacam.net
      79.134.225.9
      truetrueunknown

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      shahzad73.ddns.nettrue
      • 6%, Virustotal, Browse
      • Avira URL Cloud: safe
      unknown
      shahzad73.casacam.nettrue
      • Avira URL Cloud: safe
      unknown

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://www.apache.org/licenses/LICENSE-2.0LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
        high
        http://www.fontbureau.comLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
          high
          http://www.fontbureau.com/designersGLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
            high
            http://www.fontbureau.com/designers/?LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
              high
              http://www.founder.com.cn/cn/bTheLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              unknown
              http://www.fontbureau.comuevaLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.258728477.0000000000A17000.00000004.00000040.sdmpfalse
              • Avira URL Cloud: safe
              unknown
              https://github.com/michel-pi/EasyBot.NetLIST OF POEA DELISTED AGENCIES.pdf.exefalse
                high
                http://www.fontbureau.com/designers?LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                  high
                  http://www.tiro.comLIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  unknown
                  http://www.fontbureau.com/designersLIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                    high
                    http://www.goodfont.co.krLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    http://www.fontbureau.comaLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.258728477.0000000000A17000.00000004.00000040.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    http://www.carterandcone.comlLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    http://www.sajatypeworks.comLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    http://www.typography.netDLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    http://www.fontbureau.com/designers/cabarga.htmlNLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                      high
                      http://www.founder.com.cn/cn/cTheLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      http://www.galapagosdesign.com/staff/dennis.htmLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      http://fontfabrik.comLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      http://www.founder.com.cn/cnLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      http://www.fontbureau.com/designers/frere-jones.htmlLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                        high
                        http://www.jiyu-kobo.co.jp/LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        unknown
                        http://www.galapagosdesign.com/DPleaseLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        unknown
                        http://www.fontbureau.com/designers8LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                          high
                          http://www.fonts.comLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                            high
                            http://www.sandoll.co.krLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            unknown
                            http://www.fontbureau.comrY.LIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.258728477.0000000000A17000.00000004.00000040.sdmpfalse
                            • Avira URL Cloud: safe
                            unknown
                            http://www.urwpp.deDPleaseLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            unknown
                            http://www.zhongyicts.com.cnLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            unknown
                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.270340865.0000000007421000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.300872246.0000000006FD1000.00000004.00000001.sdmpfalse
                              high
                              http://www.sakkal.comLIST OF POEA DELISTED AGENCIES.pdf.exe, 00000000.00000002.266816780.00000000068B2000.00000004.00000001.sdmp, LIST OF POEA DELISTED AGENCIES.pdf.exe, 0000000B.00000002.299600592.0000000005790000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              unknown

                              Contacted IPs

                              • No. of IPs < 25%
                              • 25% < No. of IPs < 50%
                              • 50% < No. of IPs < 75%
                              • 75% < No. of IPs

                              Public

                              IPDomainCountryFlagASNASN NameMalicious
                              79.134.225.9
                              shahzad73.casacam.netSwitzerland
                              6775FINK-TELECOM-SERVICESCHtrue

                              General Information

                              Joe Sandbox Version:31.0.0 Emerald
                              Analysis ID:383708
                              Start date:08.04.2021
                              Start time:07:47:17
                              Joe Sandbox Product:CloudBasic
                              Overall analysis duration:0h 12m 13s
                              Hypervisor based Inspection enabled:false
                              Report type:light
                              Sample file name:LIST OF POEA DELISTED AGENCIES.pdf.exe
                              Cookbook file name:default.jbs
                              Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                              Number of analysed new started processes analysed:33
                              Number of new started drivers analysed:0
                              Number of existing processes analysed:0
                              Number of existing drivers analysed:0
                              Number of injected processes analysed:0
                              Technologies:
                              • HCA enabled
                              • EGA enabled
                              • HDC enabled
                              • AMSI enabled
                              Analysis Mode:default
                              Analysis stop reason:Timeout
                              Detection:MAL
                              Classification:mal100.troj.evad.winEXE@15/8@15/1
                              EGA Information:Failed
                              HDC Information:
                              • Successful, ratio: 0% (good quality ratio 0%)
                              • Quality average: 51%
                              • Quality standard deviation: 0%
                              HCA Information:
                              • Successful, ratio: 99%
                              • Number of executed functions: 0
                              • Number of non-executed functions: 0
                              Cookbook Comments:
                              • Adjust boot time
                              • Enable AMSI
                              • Found application associated with file extension: .exe
                              Warnings:
                              Show All
                              • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                              • TCP Packets have been reduced to 100
                              • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                              • Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 23.54.113.53, 52.147.198.201, 40.88.32.150, 95.100.54.203, 13.88.21.125, 20.82.210.154, 23.10.249.26, 23.10.249.43, 23.0.174.185, 23.0.174.200, 20.54.26.129
                              • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net
                              • Report creation exceeded maximum time and may have missing disassembly code information.
                              • Report size exceeded maximum capacity and may have missing behavior information.
                              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                              • Report size getting too big, too many NtOpenKeyEx calls found.
                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                              • Report size getting too big, too many NtQueryValueKey calls found.

                              Simulations

                              Behavior and APIs

                              TimeTypeDescription
                              07:48:17API Interceptor941x Sleep call for process: LIST OF POEA DELISTED AGENCIES.pdf.exe modified
                              07:48:26Task SchedulerRun new task: DHCP Monitor path: "C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe" s>$(Arg0)

                              Joe Sandbox View / Context

                              IPs

                              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                              79.134.225.9Gi#U00e1 FOB t#U00ednh b#U1eb1ng USD..KQ13jvZ9uFZOE8U.exeGet hashmaliciousBrowse
                                #U4ed8#U6b3e#U51ed#U8bc104R927.exeGet hashmaliciousBrowse
                                  SecuriteInfo.com.Trojan.InjectNET.14.25726.exeGet hashmaliciousBrowse
                                    SecuriteInfo.com.Trojan.Hosts.48193.7834.exeGet hashmaliciousBrowse
                                      MT-10634xls.exeGet hashmaliciousBrowse
                                        Scan_202011200113(1)xls.exeGet hashmaliciousBrowse
                                          NEW ORDER_8876630.exeGet hashmaliciousBrowse
                                            yrIVz5su2U.exeGet hashmaliciousBrowse
                                              DHL 2723382830#U6536#U636e,pdf.exeGet hashmaliciousBrowse
                                                Huidmwk.exeGet hashmaliciousBrowse
                                                  Huidmwk.exeGet hashmaliciousBrowse

                                                    Domains

                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                    shahzad73.casacam.netMemo-Circular No 018-21.pdf.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    POEA MEMO.pdf.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    RWO-NCR Advisory.pdf.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    POEA MEMO.pdf.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    Memo-Circular No 018-21 MARINA ADVISORY NO 2021-05.pdf.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    Ircg423Akc.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    POEA MEMORANDUM.PDF.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    POEA Advisory No. 109, 2021 on COVID-19.pdf.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    remittance copy.pdf.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    xbfR1CDx7S.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    swift_BILLING INVOICE.docGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    Bank Transfer Slip.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    BILLING INVOICE.pdf.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    JMG Memo-Circular No 018-21.PDF.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    POEA ADVISORY ON DELISTED AGENCIES.PDF.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    Swift copy_BILLING INVOICE.pdf.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    POEA ADVISORY ON DELISTED AGENCIES.pdf.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    POEA ADVISORY NO 450 2021.pdf.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84
                                                    POEA DELISTED AGENCIES (BATCH A).PDF.exeGet hashmaliciousBrowse
                                                    • 91.212.153.84

                                                    ASN

                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                    FINK-TELECOM-SERVICESCHAWB.pdf.exeGet hashmaliciousBrowse
                                                    • 79.134.225.102
                                                    AIC7VMxudf.exeGet hashmaliciousBrowse
                                                    • 79.134.225.30
                                                    9mm case for ROYAL METAL INDUSTRIES 3milmonth Specification drawings.exeGet hashmaliciousBrowse
                                                    • 79.134.225.21
                                                    PO50164.exeGet hashmaliciousBrowse
                                                    • 79.134.225.79
                                                    Fast color scan to a PDFfile_1_20210331084231346.pdf.exeGet hashmaliciousBrowse
                                                    • 79.134.225.102
                                                    n7dIHuG3v6.exeGet hashmaliciousBrowse
                                                    • 79.134.225.92
                                                    F6JT4fXIAQ.exeGet hashmaliciousBrowse
                                                    • 79.134.225.92
                                                    order_inquiry2094.xls.exeGet hashmaliciousBrowse
                                                    • 79.134.225.102
                                                    5H957qLghX.exeGet hashmaliciousBrowse
                                                    • 79.134.225.25
                                                    yBio5dWAOl.exeGet hashmaliciousBrowse
                                                    • 79.134.225.7
                                                    wDIaJji4Vv.exeGet hashmaliciousBrowse
                                                    • 79.134.225.7
                                                    DkZY1k3y9F.exeGet hashmaliciousBrowse
                                                    • 79.134.225.23
                                                    hbvo9thTAX.exeGet hashmaliciousBrowse
                                                    • 79.134.225.7
                                                    SCAN ORDER DOC 040202021.exeGet hashmaliciousBrowse
                                                    • 79.134.225.71
                                                    Waybill Doc_pdf.exeGet hashmaliciousBrowse
                                                    • 79.134.225.92
                                                    gfcYixSdyD.exeGet hashmaliciousBrowse
                                                    • 79.134.225.71
                                                    cJtVGjtNGZ.exeGet hashmaliciousBrowse
                                                    • 79.134.225.40
                                                    Transferwise beneficiary detailspdf.exeGet hashmaliciousBrowse
                                                    • 79.134.225.22
                                                    NS 001 DOP IPS ORIENTATIONS.docGet hashmaliciousBrowse
                                                    • 79.134.225.73
                                                    cp.msi.exeGet hashmaliciousBrowse
                                                    • 79.134.225.109

                                                    JA3 Fingerprints

                                                    No context

                                                    Dropped Files

                                                    No context

                                                    Created / dropped Files

                                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LIST OF POEA DELISTED AGENCIES.pdf.exe.log
                                                    Process:C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe
                                                    File Type:ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):1216
                                                    Entropy (8bit):5.355304211458859
                                                    Encrypted:false
                                                    SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
                                                    MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                                    SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                                    SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                                    SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                                    Malicious:false
                                                    Reputation:high, very likely benign file
                                                    Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21
                                                    C:\Users\user\AppData\Local\Temp\tmp1EF7.tmp
                                                    Process:C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe
                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):1648
                                                    Entropy (8bit):5.176749207765345
                                                    Encrypted:false
                                                    SSDEEP:24:2dH4+SEqC/a7hTlNMFpH/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBhztn:cbhC7ZlNQF/rydbz9I3YODOLNdq3t
                                                    MD5:21FDD8808218A108E28FCFAB999B711D
                                                    SHA1:8724F1BFA27D5A87431CD380A4E7B92F14745E3A
                                                    SHA-256:87A449C920E2FB74E680B6355F499A8EE116B62F7E841B49BBC48E5BEB9F6105
                                                    SHA-512:DBF4EAFDC5941288BB8091D1665F8140B314D0DDBD6D23E6FB68DF54145CA7EF6585FA1EBA7B9B0CF0258DEF950CD3773A2A120DB306D7DDEABA22060C003348
                                                    Malicious:true
                                                    Reputation:low
                                                    Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>t
                                                    C:\Users\user\AppData\Local\Temp\tmp5375.tmp
                                                    Process:C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe
                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):1648
                                                    Entropy (8bit):5.176749207765345
                                                    Encrypted:false
                                                    SSDEEP:24:2dH4+SEqC/a7hTlNMFpH/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBhztn:cbhC7ZlNQF/rydbz9I3YODOLNdq3t
                                                    MD5:21FDD8808218A108E28FCFAB999B711D
                                                    SHA1:8724F1BFA27D5A87431CD380A4E7B92F14745E3A
                                                    SHA-256:87A449C920E2FB74E680B6355F499A8EE116B62F7E841B49BBC48E5BEB9F6105
                                                    SHA-512:DBF4EAFDC5941288BB8091D1665F8140B314D0DDBD6D23E6FB68DF54145CA7EF6585FA1EBA7B9B0CF0258DEF950CD3773A2A120DB306D7DDEABA22060C003348
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>t
                                                    C:\Users\user\AppData\Local\Temp\tmpB457.tmp
                                                    Process:C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe
                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                    Category:dropped
                                                    Size (bytes):1325
                                                    Entropy (8bit):5.123968322135509
                                                    Encrypted:false
                                                    SSDEEP:24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0ParYxtn:cbk4oL600QydbQxIYODOLedq3SarYj
                                                    MD5:06778E138CFA3F83DB1A10CF4BC36E1C
                                                    SHA1:95880E16C188DFC0601A97E0C9AA9F5F26AA1628
                                                    SHA-256:94CDD87F5330C4C0B7BB6AF3421FD6DE4F009E9F7EEC1EBB3CE74BF30B396CF2
                                                    SHA-512:AB0C359D0E5810AE38D945C8CD488CFCC6FB44ADF1EA8BA5ADFCE6D58693CAB1269ECD197B74CD64247D6C56D925CA051D51E414F87984174F0481F65F69EB4B
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak
                                                    C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat
                                                    Process:C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe
                                                    File Type:data
                                                    Category:dropped
                                                    Size (bytes):2784
                                                    Entropy (8bit):7.089541637477408
                                                    Encrypted:false
                                                    SSDEEP:48:IknjhUknjhUknjhUknjhUknjhUknjhUknjhUknjhUknjhUknjhUknjhUknjhL:HjhDjhDjhDjhDjhDjhDjhDjhDjhDjhDz
                                                    MD5:1D36D3F312F677BFA382C9041352BCDB
                                                    SHA1:760113B8969928B0A7F217EDF96D2F5D7613BF43
                                                    SHA-256:789F505ECA8494C06422B61C4D696512284A0E8F3DA573ED97DBDF3721E2370D
                                                    SHA-512:8736F403BCC40A7C907C28026104B05DA0255EB5B53EF0CF3FAA81DF60927A15CCC5A5E0FE442EB06CE2F1CB6811587339341889DBC8470622FAD7672C7D012B
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview: Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+......*....~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+......*....~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+......*....~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+......*....~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.
                                                    C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
                                                    Process:C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe
                                                    File Type:Non-ISO extended-ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):8
                                                    Entropy (8bit):3.0
                                                    Encrypted:false
                                                    SSDEEP:3:6n:6
                                                    MD5:4BBA759E38EC777A16944C8F97C85C31
                                                    SHA1:1F07F5C461F63EB4F8D0E170115973BD8F2370DD
                                                    SHA-256:09205B6721CE7555EDE9C20FA1BDC52625D90900A1C0D4A41E329AC8FC4F1D2E
                                                    SHA-512:D50DC62E93CAF550171EED2C3C75E7571229644108B648675027FA139DABFE3E0C1B58AF6584620E6F889D64F74A4E69ACC876D89913698430A9457457A6F74E
                                                    Malicious:true
                                                    Reputation:low
                                                    Preview: .=i\...H
                                                    C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat
                                                    Process:C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe
                                                    File Type:ASCII text, with no line terminators
                                                    Category:dropped
                                                    Size (bytes):62
                                                    Entropy (8bit):4.73041723004934
                                                    Encrypted:false
                                                    SSDEEP:3:oNUWJRWpsp+g9ghog2TJ:oNNJACwg9grOJ
                                                    MD5:9AE7E0FF2AF6D9EB4CE4796CEC5B4818
                                                    SHA1:F28D47C4F13A78B75078275459021506B42EE14F
                                                    SHA-256:44FF48647A1E176BF1ED2ADF9FAA479C082D878431FB917B44EE84A8E0D2A4AA
                                                    SHA-512:629E099713D43EAFE5E64590E1CD0168658FF458F07230B11A159DD2265D4149A6A800B7D80AB619DBFA1C2FBB7DDADFB9BA84120AD1560E32360EC5D0499559
                                                    Malicious:false
                                                    Reputation:low
                                                    Preview: C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe
                                                    C:\Users\user\AppData\Roaming\lYcqUUrbhRC.exe
                                                    Process:C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe
                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Category:dropped
                                                    Size (bytes):756736
                                                    Entropy (8bit):7.894509991682861
                                                    Encrypted:false
                                                    SSDEEP:12288:Yf0Plu2iNSbc3TKa00gTBz4CJOqW2WZrpyszp3AKlOALeCmxaMdGkq0yTOI:hdu1xTKacuCIqW2WNpyszpQKlreCmzGr
                                                    MD5:170934B168C75ED396332A6AF365A478
                                                    SHA1:9089F509AAE08997E6C8DA1A33F3C5156A6F06BC
                                                    SHA-256:1B7D2AE0FAED1DB793CFCF75E11CC0308C69AF37540D27B9DBD104D0F850A658
                                                    SHA-512:938C117C81509373F841970EA06AFF42A3E9C455712AD8DD27851D0580C1C9D08AD16A00DA4E334CA10F9A58867A00530B5027E39F0D99D907F00C79AB8E97BD
                                                    Malicious:false
                                                    Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....n`..............0.................. ........@.. ....................................@.................................`...O.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H...........d...........hZ...F..........................................^..}.....(.......(.....*..*..0..+.........,..{.......+....,...{....o........(.....*..0................(....s......s....}.....s....}.....s....}.....s....}.....s....}.....s ...}.....s!...}.....s"...}.....{....o#.....{....o$.....(#.....{.....o%.....{....o&...."...Bs'...o(...&.{....o&...."...Bs'...o(...&.{....o)....{......o*.....{....o)....{......o*.....{....o)....{......o*.....{....o)....{......o*.....{....o

                                                    Static File Info

                                                    General

                                                    File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                    Entropy (8bit):7.894509991682861
                                                    TrID:
                                                    • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                    • Win32 Executable (generic) a (10002005/4) 49.75%
                                                    • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                    • Windows Screen Saver (13104/52) 0.07%
                                                    • Generic Win/DOS Executable (2004/3) 0.01%
                                                    File name:LIST OF POEA DELISTED AGENCIES.pdf.exe
                                                    File size:756736
                                                    MD5:170934b168c75ed396332a6af365a478
                                                    SHA1:9089f509aae08997e6c8da1a33f3c5156a6f06bc
                                                    SHA256:1b7d2ae0faed1db793cfcf75e11cc0308c69af37540d27b9dbd104d0f850a658
                                                    SHA512:938c117c81509373f841970ea06aff42a3e9c455712ad8dd27851d0580c1c9d08ad16a00da4e334ca10f9a58867a00530b5027e39f0d99d907f00c79ab8e97bd
                                                    SSDEEP:12288:Yf0Plu2iNSbc3TKa00gTBz4CJOqW2WZrpyszp3AKlOALeCmxaMdGkq0yTOI:hdu1xTKacuCIqW2WNpyszpQKlreCmzGr
                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....n`..............0.................. ........@.. ....................................@................................

                                                    File Icon

                                                    Icon Hash:00828e8e8686b000

                                                    Static PE Info

                                                    General

                                                    Entrypoint:0x4ba1b2
                                                    Entrypoint Section:.text
                                                    Digitally signed:false
                                                    Imagebase:0x400000
                                                    Subsystem:windows gui
                                                    Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                    DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                    Time Stamp:0x606E938B [Thu Apr 8 05:24:27 2021 UTC]
                                                    TLS Callbacks:
                                                    CLR (.Net) Version:v4.0.30319
                                                    OS Version Major:4
                                                    OS Version Minor:0
                                                    File Version Major:4
                                                    File Version Minor:0
                                                    Subsystem Version Major:4
                                                    Subsystem Version Minor:0
                                                    Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                    Entrypoint Preview

                                                    Instruction
                                                    jmp dword ptr [00402000h]
                                                    mov dword ptr [eax+4Eh], edx
                                                    inc edi
                                                    or eax, 000A1A0Ah
                                                    add byte ptr [eax], al
                                                    add byte ptr [ecx+45h], cl
                                                    dec esi
                                                    inc esp
                                                    scasb
                                                    inc edx
                                                    pushad
                                                    add byte ptr [eax], 00000000h
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al
                                                    add byte ptr [eax], al

                                                    Data Directories

                                                    NameVirtual AddressVirtual Size Is in Section
                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0xba1600x4f.text
                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0xbc0000x5bc.rsrc
                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0xbe0000xc.reloc
                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                    Sections

                                                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                    .text0x20000xb81d00xb8200False0.907598491599data7.90065645819IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                    .rsrc0xbc0000x5bc0x600False0.428385416667data4.16709322798IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                    .reloc0xbe0000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                    Resources

                                                    NameRVASizeTypeLanguageCountry
                                                    RT_VERSION0xbc0900x32cdata
                                                    RT_MANIFEST0xbc3cc0x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                                    Imports

                                                    DLLImport
                                                    mscoree.dll_CorExeMain

                                                    Version Infos

                                                    DescriptionData
                                                    Translation0x0000 0x04b0
                                                    LegalCopyrightCopyright 2018 - 2021
                                                    Assembly Version3.1.0.5
                                                    InternalNameJGg.exe
                                                    FileVersion3.1.0.5
                                                    CompanyName
                                                    LegalTrademarks
                                                    Comments
                                                    ProductNameImage Manager
                                                    ProductVersion3.1.0.5
                                                    FileDescriptionImage Manager
                                                    OriginalFilenameJGg.exe

                                                    Network Behavior

                                                    Snort IDS Alerts

                                                    TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                    04/08/21-07:48:27.180566TCP2025019ET TROJAN Possible NanoCore C2 60B497059036192.168.2.579.134.225.9
                                                    04/08/21-07:48:34.865853TCP2025019ET TROJAN Possible NanoCore C2 60B497069036192.168.2.579.134.225.9
                                                    04/08/21-07:48:41.371122TCP2025019ET TROJAN Possible NanoCore C2 60B497089036192.168.2.579.134.225.9
                                                    04/08/21-07:48:51.473538TCP2025019ET TROJAN Possible NanoCore C2 60B497129036192.168.2.579.134.225.9
                                                    04/08/21-07:48:58.549058TCP2025019ET TROJAN Possible NanoCore C2 60B497189036192.168.2.579.134.225.9
                                                    04/08/21-07:49:05.479859TCP2025019ET TROJAN Possible NanoCore C2 60B497209036192.168.2.579.134.225.9
                                                    04/08/21-07:49:12.586754TCP2025019ET TROJAN Possible NanoCore C2 60B497219036192.168.2.579.134.225.9
                                                    04/08/21-07:49:19.709242TCP2025019ET TROJAN Possible NanoCore C2 60B497249036192.168.2.579.134.225.9
                                                    04/08/21-07:49:26.263194TCP2025019ET TROJAN Possible NanoCore C2 60B497309036192.168.2.579.134.225.9
                                                    04/08/21-07:49:33.336462TCP2025019ET TROJAN Possible NanoCore C2 60B497319036192.168.2.579.134.225.9
                                                    04/08/21-07:49:43.348194TCP2025019ET TROJAN Possible NanoCore C2 60B497329036192.168.2.579.134.225.9
                                                    04/08/21-07:49:49.428114TCP2025019ET TROJAN Possible NanoCore C2 60B497339036192.168.2.579.134.225.9
                                                    04/08/21-07:49:56.532596TCP2025019ET TROJAN Possible NanoCore C2 60B497369036192.168.2.579.134.225.9
                                                    04/08/21-07:50:03.559289TCP2025019ET TROJAN Possible NanoCore C2 60B497379036192.168.2.579.134.225.9
                                                    04/08/21-07:50:10.669991TCP2025019ET TROJAN Possible NanoCore C2 60B497389036192.168.2.579.134.225.9

                                                    Network Port Distribution

                                                    TCP Packets

                                                    TimestampSource PortDest PortSource IPDest IP
                                                    Apr 8, 2021 07:48:26.866081953 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:27.123334885 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:27.123454094 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:27.180566072 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:27.464819908 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:27.522058964 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:27.550477028 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:27.773880005 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:27.810262918 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.079947948 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.102189064 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.107131958 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.109965086 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.112442970 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.117477894 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.119174004 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.220895052 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.334566116 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.334588051 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.334700108 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.339201927 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.342142105 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.345869064 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.345936060 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.351286888 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.351397991 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.356271982 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.356365919 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.362250090 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.362319946 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.368325949 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.368392944 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.489358902 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.559335947 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.563226938 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.563474894 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.567389011 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.573513985 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.575066090 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.579336882 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.586924076 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.588799000 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.591115952 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.596718073 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.596848011 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.601644039 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.605289936 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.608308077 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.611953974 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.617472887 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.617559910 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.624857903 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.629694939 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.629854918 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.635412931 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.640856981 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.640968084 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.783225060 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.788338900 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.788439035 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.795783997 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.801173925 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.801253080 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.806395054 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.816768885 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.816859007 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.824079037 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.827111006 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.827250004 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.831958055 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.836673021 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.836730003 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.844211102 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.851360083 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.851458073 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.854172945 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.857846022 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.857894897 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.862154961 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.866118908 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.866183043 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.871197939 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.874090910 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.875751019 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.878529072 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.883141041 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.883202076 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.886209011 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.888813019 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.888860941 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.891371965 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.893531084 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.893589020 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.899333954 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.903410912 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.903456926 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.905775070 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.911732912 CEST90364970579.134.225.9192.168.2.5
                                                    Apr 8, 2021 07:48:28.911789894 CEST497059036192.168.2.579.134.225.9
                                                    Apr 8, 2021 07:48:28.912324905 CEST90364970579.134.225.9192.168.2.5

                                                    UDP Packets

                                                    TimestampSource PortDest PortSource IPDest IP
                                                    Apr 8, 2021 07:48:00.896857023 CEST5378453192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:00.923322916 CEST53537848.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:02.408575058 CEST6530753192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:02.427350044 CEST53653078.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:06.749180079 CEST6434453192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:06.762243986 CEST53643448.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:11.783354998 CEST6206053192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:11.796008110 CEST53620608.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:12.681210995 CEST6180553192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:12.695575953 CEST53618058.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:13.369292974 CEST5479553192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:13.381272078 CEST53547958.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:18.824450970 CEST4955753192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:18.840527058 CEST53495578.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:24.758177996 CEST6173353192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:24.773238897 CEST53617338.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:26.554634094 CEST6544753192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:26.574033976 CEST53654478.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:26.831653118 CEST5244153192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:26.844439983 CEST53524418.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:34.417330980 CEST6217653192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:34.596225023 CEST53621768.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:40.197369099 CEST5959653192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:40.212357998 CEST53595968.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:41.047751904 CEST6529653192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:41.060312033 CEST53652968.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:41.099203110 CEST6318353192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:41.115523100 CEST53631838.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:41.416022062 CEST6015153192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:41.428499937 CEST53601518.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:48.194073915 CEST5696953192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:48.207519054 CEST53569698.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:48.250762939 CEST5516153192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:48.268780947 CEST53551618.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:52.499470949 CEST5475753192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:52.512556076 CEST53547578.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:53.715282917 CEST4999253192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:53.729660034 CEST53499928.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:54.344264030 CEST6007553192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:54.357188940 CEST53600758.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:56.016964912 CEST5501653192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:56.037491083 CEST53550168.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:48:58.308763027 CEST6434553192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:48:58.324584007 CEST53643458.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:49:01.351356983 CEST5712853192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:49:01.390177011 CEST53571288.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:49:05.247042894 CEST5479153192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:49:05.262593985 CEST53547918.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:49:12.299179077 CEST5046353192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:49:12.311767101 CEST53504638.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:49:18.401609898 CEST5039453192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:49:18.415184975 CEST53503948.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:49:19.285248995 CEST5853053192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:49:19.463937044 CEST53585308.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:49:21.707190037 CEST5381353192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:49:21.728830099 CEST53538138.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:49:26.016213894 CEST6373253192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:49:26.028558016 CEST53637328.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:49:33.096348047 CEST5734453192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:49:33.109216928 CEST53573448.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:49:40.105407000 CEST5445053192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:49:40.118659973 CEST53544508.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:49:49.194911957 CEST5926153192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:49:49.208095074 CEST53592618.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:49:52.491797924 CEST5715153192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:49:52.504312038 CEST53571518.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:49:54.534698963 CEST5941353192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:49:54.563549042 CEST53594138.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:49:56.283787966 CEST6051653192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:49:56.298697948 CEST53605168.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:50:03.256059885 CEST5164953192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:50:03.268548965 CEST53516498.8.8.8192.168.2.5
                                                    Apr 8, 2021 07:50:10.280827045 CEST6508653192.168.2.58.8.8.8
                                                    Apr 8, 2021 07:50:10.417323112 CEST53650868.8.8.8192.168.2.5

                                                    DNS Queries

                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                    Apr 8, 2021 07:48:26.831653118 CEST192.168.2.58.8.8.80x117aStandard query (0)shahzad73.casacam.netA (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:48:34.417330980 CEST192.168.2.58.8.8.80x5fb4Standard query (0)shahzad73.casacam.netA (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:48:41.099203110 CEST192.168.2.58.8.8.80xdddfStandard query (0)shahzad73.casacam.netA (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:48:48.194073915 CEST192.168.2.58.8.8.80x9a64Standard query (0)shahzad73.casacam.netA (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:48:58.308763027 CEST192.168.2.58.8.8.80x6c03Standard query (0)shahzad73.casacam.netA (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:05.247042894 CEST192.168.2.58.8.8.80xe4cStandard query (0)shahzad73.casacam.netA (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:12.299179077 CEST192.168.2.58.8.8.80xc737Standard query (0)shahzad73.casacam.netA (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:19.285248995 CEST192.168.2.58.8.8.80xbb26Standard query (0)shahzad73.casacam.netA (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:26.016213894 CEST192.168.2.58.8.8.80xc029Standard query (0)shahzad73.casacam.netA (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:33.096348047 CEST192.168.2.58.8.8.80xb015Standard query (0)shahzad73.casacam.netA (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:40.105407000 CEST192.168.2.58.8.8.80x279dStandard query (0)shahzad73.casacam.netA (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:49.194911957 CEST192.168.2.58.8.8.80x24daStandard query (0)shahzad73.casacam.netA (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:56.283787966 CEST192.168.2.58.8.8.80xe4d0Standard query (0)shahzad73.casacam.netA (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:50:03.256059885 CEST192.168.2.58.8.8.80x9dc1Standard query (0)shahzad73.casacam.netA (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:50:10.280827045 CEST192.168.2.58.8.8.80x8a2aStandard query (0)shahzad73.casacam.netA (IP address)IN (0x0001)

                                                    DNS Answers

                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                    Apr 8, 2021 07:48:26.844439983 CEST8.8.8.8192.168.2.50x117aNo error (0)shahzad73.casacam.net79.134.225.9A (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:48:34.596225023 CEST8.8.8.8192.168.2.50x5fb4No error (0)shahzad73.casacam.net79.134.225.9A (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:48:41.115523100 CEST8.8.8.8192.168.2.50xdddfNo error (0)shahzad73.casacam.net79.134.225.9A (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:48:48.207519054 CEST8.8.8.8192.168.2.50x9a64No error (0)shahzad73.casacam.net79.134.225.9A (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:48:58.324584007 CEST8.8.8.8192.168.2.50x6c03No error (0)shahzad73.casacam.net79.134.225.9A (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:05.262593985 CEST8.8.8.8192.168.2.50xe4cNo error (0)shahzad73.casacam.net79.134.225.9A (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:12.311767101 CEST8.8.8.8192.168.2.50xc737No error (0)shahzad73.casacam.net79.134.225.9A (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:19.463937044 CEST8.8.8.8192.168.2.50xbb26No error (0)shahzad73.casacam.net79.134.225.9A (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:26.028558016 CEST8.8.8.8192.168.2.50xc029No error (0)shahzad73.casacam.net79.134.225.9A (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:33.109216928 CEST8.8.8.8192.168.2.50xb015No error (0)shahzad73.casacam.net79.134.225.9A (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:40.118659973 CEST8.8.8.8192.168.2.50x279dNo error (0)shahzad73.casacam.net79.134.225.9A (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:49.208095074 CEST8.8.8.8192.168.2.50x24daNo error (0)shahzad73.casacam.net79.134.225.9A (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:49:56.298697948 CEST8.8.8.8192.168.2.50xe4d0No error (0)shahzad73.casacam.net79.134.225.9A (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:50:03.268548965 CEST8.8.8.8192.168.2.50x9dc1No error (0)shahzad73.casacam.net79.134.225.9A (IP address)IN (0x0001)
                                                    Apr 8, 2021 07:50:10.417323112 CEST8.8.8.8192.168.2.50x8a2aNo error (0)shahzad73.casacam.net79.134.225.9A (IP address)IN (0x0001)

                                                    Code Manipulations

                                                    Statistics

                                                    Behavior

                                                    Click to jump to process

                                                    System Behavior

                                                    General

                                                    Start time:07:48:07
                                                    Start date:08/04/2021
                                                    Path:C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe
                                                    Wow64 process (32bit):true
                                                    Commandline:'C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe'
                                                    Imagebase:0x400000
                                                    File size:756736 bytes
                                                    MD5 hash:170934B168C75ED396332A6AF365A478
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:.Net C# or VB.NET
                                                    Yara matches:
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.259633262.00000000038F9000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.259633262.00000000038F9000.00000004.00000001.sdmp, Author: Joe Security
                                                    • Rule: NanoCore, Description: unknown, Source: 00000000.00000002.259633262.00000000038F9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                    Reputation:low

                                                    General

                                                    Start time:07:48:20
                                                    Start date:08/04/2021
                                                    Path:C:\Windows\SysWOW64\schtasks.exe
                                                    Wow64 process (32bit):true
                                                    Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\lYcqUUrbhRC' /XML 'C:\Users\user\AppData\Local\Temp\tmp1EF7.tmp'
                                                    Imagebase:0xd90000
                                                    File size:185856 bytes
                                                    MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high

                                                    General

                                                    Start time:07:48:21
                                                    Start date:08/04/2021
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff7ecfc0000
                                                    File size:625664 bytes
                                                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high

                                                    General

                                                    Start time:07:48:21
                                                    Start date:08/04/2021
                                                    Path:C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe
                                                    Wow64 process (32bit):true
                                                    Commandline:{path}
                                                    Imagebase:0x920000
                                                    File size:756736 bytes
                                                    MD5 hash:170934B168C75ED396332A6AF365A478
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:.Net C# or VB.NET
                                                    Yara matches:
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.504910894.0000000005340000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000007.00000002.504910894.0000000005340000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.505287922.0000000005780000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000007.00000002.505287922.0000000005780000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000007.00000002.505287922.0000000005780000.00000004.00000001.sdmp, Author: Joe Security
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.505774970.0000000006620000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000007.00000002.505774970.0000000006620000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.505788129.0000000006630000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000007.00000002.505788129.0000000006630000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.505834895.0000000006670000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000007.00000002.505834895.0000000006670000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.505731790.00000000065F0000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000007.00000002.505731790.00000000065F0000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.505705551.00000000065D0000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000007.00000002.505705551.00000000065D0000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.505744453.0000000006600000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000007.00000002.505744453.0000000006600000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.505679942.00000000065B0000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000007.00000002.505679942.00000000065B0000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: NanoCore, Description: unknown, Source: 00000007.00000002.502325933.00000000040DD000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.505693803.00000000065C0000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000007.00000002.505693803.00000000065C0000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.505618683.0000000006560000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000007.00000002.505618683.0000000006560000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000007.00000002.497876017.0000000002DE1000.00000004.00000001.sdmp, Author: Joe Security
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.505717572.00000000065E0000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000007.00000002.505717572.00000000065E0000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp, Author: Joe Security
                                                    • Rule: NanoCore, Description: unknown, Source: 00000007.00000002.501649897.0000000003DE1000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.493270074.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth
                                                    • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000007.00000002.493270074.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                    • Rule: NanoCore, Description: unknown, Source: 00000007.00000002.493270074.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.505218094.0000000005550000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000007.00000002.505218094.0000000005550000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000007.00000002.501964198.0000000003F3F000.00000004.00000001.sdmp, Author: Joe Security
                                                    • Rule: NanoCore, Description: unknown, Source: 00000007.00000002.501964198.0000000003F3F000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.505667640.00000000065A0000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000007.00000002.505667640.00000000065A0000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000007.00000002.502093667.0000000003FEF000.00000004.00000001.sdmp, Author: Joe Security
                                                    • Rule: NanoCore, Description: unknown, Source: 00000007.00000002.502093667.0000000003FEF000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                    • Rule: NanoCore, Description: unknown, Source: 00000007.00000002.498112941.0000000002E4C000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                    Reputation:low

                                                    General

                                                    Start time:07:48:24
                                                    Start date:08/04/2021
                                                    Path:C:\Windows\SysWOW64\schtasks.exe
                                                    Wow64 process (32bit):true
                                                    Commandline:'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpB457.tmp'
                                                    Imagebase:0xba0000
                                                    File size:185856 bytes
                                                    MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high

                                                    General

                                                    Start time:07:48:24
                                                    Start date:08/04/2021
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff7ecfc0000
                                                    File size:625664 bytes
                                                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high

                                                    General

                                                    Start time:07:48:27
                                                    Start date:08/04/2021
                                                    Path:C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe
                                                    Wow64 process (32bit):true
                                                    Commandline:'C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe' 0
                                                    Imagebase:0x430000
                                                    File size:756736 bytes
                                                    MD5 hash:170934B168C75ED396332A6AF365A478
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:.Net C# or VB.NET
                                                    Yara matches:
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000002.294311257.0000000003869000.00000004.00000001.sdmp, Author: Florian Roth
                                                    • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000002.294311257.0000000003869000.00000004.00000001.sdmp, Author: Joe Security
                                                    • Rule: NanoCore, Description: unknown, Source: 0000000B.00000002.294311257.0000000003869000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                    Reputation:low

                                                    General

                                                    Start time:07:48:34
                                                    Start date:08/04/2021
                                                    Path:C:\Windows\SysWOW64\schtasks.exe
                                                    Wow64 process (32bit):true
                                                    Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\lYcqUUrbhRC' /XML 'C:\Users\user\AppData\Local\Temp\tmp5375.tmp'
                                                    Imagebase:0xd50000
                                                    File size:185856 bytes
                                                    MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high

                                                    General

                                                    Start time:07:48:34
                                                    Start date:08/04/2021
                                                    Path:C:\Windows\System32\conhost.exe
                                                    Wow64 process (32bit):false
                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    Imagebase:0x7ff7ecfc0000
                                                    File size:625664 bytes
                                                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:C, C++ or other language
                                                    Reputation:high

                                                    General

                                                    Start time:07:48:35
                                                    Start date:08/04/2021
                                                    Path:C:\Users\user\Desktop\LIST OF POEA DELISTED AGENCIES.pdf.exe
                                                    Wow64 process (32bit):true
                                                    Commandline:{path}
                                                    Imagebase:0xfc0000
                                                    File size:756736 bytes
                                                    MD5 hash:170934B168C75ED396332A6AF365A478
                                                    Has elevated privileges:true
                                                    Has administrator privileges:true
                                                    Programmed in:.Net C# or VB.NET
                                                    Yara matches:
                                                    • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmp, Author: Joe Security
                                                    • Rule: NanoCore, Description: unknown, Source: 00000013.00000002.309866896.0000000004429000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                    • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000013.00000002.308929356.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth
                                                    • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000013.00000002.308929356.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                    • Rule: NanoCore, Description: unknown, Source: 00000013.00000002.308929356.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                    • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000013.00000002.309746032.0000000003421000.00000004.00000001.sdmp, Author: Joe Security
                                                    • Rule: NanoCore, Description: unknown, Source: 00000013.00000002.309746032.0000000003421000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                    Reputation:low

                                                    Disassembly

                                                    Code Analysis

                                                    Reset < >