Analysis Report cd61fe0ebfe9f6326cd5a4df9747e72c.exe

Overview

General Information

Sample Name: cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Analysis ID: 402423
MD5: cafe59d79e00e211548d5e569931e70e
SHA1: d7fbfd97e93dec7490ef06c24e2d373127ce56eb
SHA256: 4b603d683f975207871344aa9790ac649bd15c98cceecf626b92a1d3d8fd85f4
Tags: exeNanoCoreRAT
Infos:

Most interesting Screenshot:

Detection

Nanocore
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected Nanocore Rat
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Yara detected AntiVM3
Yara detected Nanocore RAT
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000001.00000002.488801787.0000000004459000.00000004.00000001.sdmp Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "25d2fcba-c6f2-4766-acfe-f43fa2f1", "Group": "saviour", "Domain1": "cloudhost.myfirewall.org", "Domain2": "cloudhost.myfirewall.org", "Port": 5456, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "cloudhost.myfirewall.org", "BackupDNSServer": "cloudhost.myfirewall.org", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}
Multi AV Scanner detection for domain / URL
Source: cloudhost.myfirewall.org Virustotal: Detection: 8% Perma Link
Source: cloudhost.myfirewall.org Virustotal: Detection: 8% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe ReversingLabs: Detection: 23%
Multi AV Scanner detection for submitted file
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe ReversingLabs: Detection: 25%
Yara detected Nanocore RAT
Source: Yara match File source: 0000000A.00000002.292598003.0000000002A21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.305109543.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.488801787.0000000004459000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.306683734.0000000003F89000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.290898353.00000000031D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.274520141.0000000004059000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.289163047.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.284508167.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.484987240.0000000003411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.291112478.00000000041D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.295474134.0000000004129000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.479870738.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.306608313.0000000002F81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.490630071.0000000006890000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.293253440.0000000003A29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.237161561.00000000040E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.274443364.0000000003F09000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 3468, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 5064, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 3156, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 6124, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5644, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2160, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5932, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2224, type: MEMORY
Source: Yara match File source: 12.2.dhcpmon.exe.42205dc.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fd05dc.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a74c05.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.4224c05.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a6b7a6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.dhcpmon.exe.4292e10.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.dhcpmon.exe.4362e10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fcb7a6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a705dc.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fd4c05.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4464c05.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.44605dc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6890000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.44605dc.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.42205dc.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6894629.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a705dc.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.421b7a6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.445b7a6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6890000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fd05dc.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.dhcpmon.exe.4292e10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.406c9c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.dhcpmon.exe.4362e10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.dhcpmon.exe.41bc9c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.dhcpmon.exe.428c9c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.424c9c0.1.raw.unpack, type: UNPACKEDPE
Antivirus or Machine Learning detection for unpacked file
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.2.dhcpmon.exe.400000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 14.2.dhcpmon.exe.400000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6890000.10.unpack Avira: Label: TR/NanoCore.fadte

Compliance:

barindex
Uses 32bit PE files
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: dows\dll\mscorlib.pdbGk source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.483797356.00000000015D2000.00000004.00000020.sdmp

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: cloudhost.myfirewall.org
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49700 -> 45.154.4.64:5456
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 45.154.4.64 45.154.4.64
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: COMBAHTONcombahtonGmbHDE COMBAHTONcombahtonGmbHDE
Source: unknown DNS traffic detected: queries for: cloudhost.myfirewall.org
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000003.215119178.000000000606E000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000003.215119178.000000000606E000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com;y
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000003.215119178.000000000606E000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comWxU
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000003.215119178.000000000606E000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comn-u
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000003.233257404.0000000006038000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.come.com
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000003.233257404.0000000006038000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comgrito
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000003.233257404.0000000006038000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comm
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000003.233257404.0000000006038000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.commc
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000003.214236957.000000000606E000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000003.213440503.000000000606E000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000003.213413683.000000000606E000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.comEF
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000003.213423068.000000000604B000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.comY
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.243134558.0000000007242000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278971780.0000000005EF0000.00000002.00000001.sdmp, dhcpmon.exe, 00000007.00000002.279684540.0000000006000000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.299680250.0000000006130000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a raw input device (often for capturing keystrokes)
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.488801787.0000000004459000.00000004.00000001.sdmp Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

barindex
Yara detected Nanocore RAT
Source: Yara match File source: 0000000A.00000002.292598003.0000000002A21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.305109543.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.488801787.0000000004459000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.306683734.0000000003F89000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.290898353.00000000031D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.274520141.0000000004059000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.289163047.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.284508167.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.484987240.0000000003411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.291112478.00000000041D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.295474134.0000000004129000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.479870738.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.306608313.0000000002F81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.490630071.0000000006890000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.293253440.0000000003A29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.237161561.00000000040E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.274443364.0000000003F09000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 3468, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 5064, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 3156, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 6124, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5644, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2160, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5932, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2224, type: MEMORY
Source: Yara match File source: 12.2.dhcpmon.exe.42205dc.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fd05dc.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a74c05.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.4224c05.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a6b7a6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.dhcpmon.exe.4292e10.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.dhcpmon.exe.4362e10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fcb7a6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a705dc.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fd4c05.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4464c05.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.44605dc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6890000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.44605dc.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.42205dc.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6894629.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a705dc.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.421b7a6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.445b7a6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6890000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fd05dc.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.dhcpmon.exe.4292e10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.406c9c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.dhcpmon.exe.4362e10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.dhcpmon.exe.41bc9c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.dhcpmon.exe.428c9c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.424c9c0.1.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000001.00000002.489985311.0000000005940000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000002.305109543.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000E.00000002.305109543.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.488801787.0000000004459000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000002.306683734.0000000003F89000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.290898353.00000000031D1000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000007.00000002.274520141.0000000004059000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000007.00000002.274520141.0000000004059000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.289163047.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.289163047.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000002.284508167.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000002.284508167.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000002.292765353.0000000002A59000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.291112478.00000000041D9000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000002.295474134.0000000004129000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000002.295474134.0000000004129000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.479870738.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.479870738.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000E.00000002.306608313.0000000002F81000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.490630071.0000000006890000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000002.293253440.0000000003A29000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.237161561.00000000040E9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.237161561.00000000040E9000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000002.274443364.0000000003F09000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.274443364.0000000003F09000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 3468, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 3468, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 5064, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 5064, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 3156, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 3156, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 6124, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 6124, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5644, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5644, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2160, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2160, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5932, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5932, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2224, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2224, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.2fbec20.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.42205dc.5.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.3209dd0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.3fd05dc.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a74c05.6.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.4224c05.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a6b7a6.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a6b7a6.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.dhcpmon.exe.4292e10.2.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.dhcpmon.exe.4362e10.1.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.3fcb7a6.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.343ca68.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.dhcpmon.exe.4362e10.1.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.dhcpmon.exe.4292e10.2.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 14.2.dhcpmon.exe.3fcb7a6.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a705dc.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.3fd4c05.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.5940000.7.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4464c05.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.2a89714.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.44605dc.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6890000.10.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.44605dc.3.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.dhcpmon.exe.42205dc.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6894629.11.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a705dc.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.dhcpmon.exe.421b7a6.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.421b7a6.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.445b7a6.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.445b7a6.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.2a4cd70.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6890000.10.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 14.2.dhcpmon.exe.3fd05dc.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.dhcpmon.exe.4292e10.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.dhcpmon.exe.4292e10.2.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.406c9c0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.406c9c0.2.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.dhcpmon.exe.4362e10.1.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.dhcpmon.exe.4362e10.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.dhcpmon.exe.41bc9c0.1.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.dhcpmon.exe.41bc9c0.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.dhcpmon.exe.428c9c0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.dhcpmon.exe.428c9c0.2.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.424c9c0.1.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.424c9c0.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Detected potential crypto function
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_015BC204 0_2_015BC204
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_015BE5D0 0_2_015BE5D0
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_015BE5C0 0_2_015BE5C0
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02ECE240 0_2_02ECE240
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02ECEB10 0_2_02ECEB10
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02EC2930 0_2_02EC2930
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02EC12E8 0_2_02EC12E8
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02EC12D8 0_2_02EC12D8
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02ECE235 0_2_02ECE235
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02EC0040 0_2_02EC0040
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02EC0006 0_2_02EC0006
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02ECDEF8 0_2_02ECDEF8
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02EC4D4C 0_2_02EC4D4C
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02EC4D50 0_2_02EC4D50
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02F47B10 0_2_02F47B10
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02F40040 0_2_02F40040
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02F43910 0_2_02F43910
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02F43678 0_2_02F43678
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02F433B0 0_2_02F433B0
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02F433A0 0_2_02F433A0
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02F43900 0_2_02F43900
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 1_2_0182E480 1_2_0182E480
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 1_2_0182E471 1_2_0182E471
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 1_2_0182BBD4 1_2_0182BBD4
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 1_2_0589F5F8 1_2_0589F5F8
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 1_2_05899788 1_2_05899788
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 1_2_0589A5D0 1_2_0589A5D0
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 1_2_0589A610 1_2_0589A610
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_0136C204 6_2_0136C204
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_0136E5D0 6_2_0136E5D0
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_0136E5C3 6_2_0136E5C3
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C3E240 6_2_02C3E240
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C3EB10 6_2_02C3EB10
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C32930 6_2_02C32930
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C312D8 6_2_02C312D8
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C312E8 6_2_02C312E8
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C30040 6_2_02C30040
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C3001B 6_2_02C3001B
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C3DEF8 6_2_02C3DEF8
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C3470A 6_2_02C3470A
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C34D50 6_2_02C34D50
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C34D3B 6_2_02C34D3B
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02CB0040 6_2_02CB0040
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02CB3910 6_2_02CB3910
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02CB3678 6_2_02CB3678
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02CB33A0 6_2_02CB33A0
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02CB33B0 6_2_02CB33B0
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02CB3900 6_2_02CB3900
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02CB3668 6_2_02CB3668
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02EEF648 6_2_02EEF648
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02EE4970 6_2_02EE4970
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_0151C204 7_2_0151C204
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_0151E5D0 7_2_0151E5D0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_0151E5C0 7_2_0151E5C0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02E6E240 7_2_02E6E240
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02E6EB10 7_2_02E6EB10
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02E62930 7_2_02E62930
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02E612E8 7_2_02E612E8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02E612D8 7_2_02E612D8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02E60040 7_2_02E60040
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02E60006 7_2_02E60006
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02E6470A 7_2_02E6470A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02E6DEF8 7_2_02E6DEF8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02E64C7A 7_2_02E64C7A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02E64D50 7_2_02E64D50
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02EE0040 7_2_02EE0040
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02EE3910 7_2_02EE3910
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02EE3678 7_2_02EE3678
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02EE33A0 7_2_02EE33A0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02EE33B0 7_2_02EE33B0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02EE3900 7_2_02EE3900
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02EE3668 7_2_02EE3668
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 7_2_02EE7C18 7_2_02EE7C18
Sample file is different than original file name gathered from version info
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000000.211226487.0000000000C3C000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameHWZinl0yCvGMAUeP.exeN vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.234506945.0000000003134000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSmartFormat.dll8 vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.246177375.0000000007C00000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000000.232533017.0000000000F6C000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameHWZinl0yCvGMAUeP.exeN vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.488801787.0000000004459000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameClientPlugin.dll4 vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.488801787.0000000004459000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameLzma#.dll4 vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.488801787.0000000004459000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.490502818.00000000067A0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.483761727.00000000015AA000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.491028151.00000000073B0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.278084679.00000000054D0000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSmartFormat.dll8 vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000000.247575196.0000000000ACC000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameHWZinl0yCvGMAUeP.exeN vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.280617361.0000000007280000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.267849385.000000000115A000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 0000000A.00000002.292598003.0000000002A21000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameClientPlugin.dll4 vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 0000000A.00000002.289320632.000000000065C000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameHWZinl0yCvGMAUeP.exeN vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 0000000A.00000002.292765353.0000000002A59000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 0000000A.00000002.291022910.0000000000C7A000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 0000000A.00000002.293253440.0000000003A29000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameLzma#.dll4 vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe Binary or memory string: OriginalFilenameHWZinl0yCvGMAUeP.exeN vs cd61fe0ebfe9f6326cd5a4df9747e72c.exe
Uses 32bit PE files
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Yara signature match
Source: 00000001.00000002.489985311.0000000005940000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.489985311.0000000005940000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000E.00000002.305109543.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000E.00000002.305109543.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000002.488801787.0000000004459000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000E.00000002.306683734.0000000003F89000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.290898353.00000000031D1000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000007.00000002.274520141.0000000004059000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000007.00000002.274520141.0000000004059000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.289163047.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.289163047.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000A.00000002.284508167.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000A.00000002.284508167.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000A.00000002.292765353.0000000002A59000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.291112478.00000000041D9000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000002.295474134.0000000004129000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000002.295474134.0000000004129000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000002.479870738.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.479870738.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000E.00000002.306608313.0000000002F81000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000002.490630071.0000000006890000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.490630071.0000000006890000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000A.00000002.293253440.0000000003A29000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.237161561.00000000040E9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.237161561.00000000040E9000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000002.274443364.0000000003F09000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.274443364.0000000003F09000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 3468, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 3468, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 5064, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 5064, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 3156, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 3156, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 6124, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 6124, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5644, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5644, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2160, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2160, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5932, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5932, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2224, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2224, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.dhcpmon.exe.2fbec20.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.2fbec20.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.dhcpmon.exe.42205dc.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.42205dc.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.dhcpmon.exe.3209dd0.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.3209dd0.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.dhcpmon.exe.3fd05dc.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.3fd05dc.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a74c05.6.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a74c05.6.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.dhcpmon.exe.4224c05.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.4224c05.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a6b7a6.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a6b7a6.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a6b7a6.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 7.2.dhcpmon.exe.4292e10.2.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.dhcpmon.exe.4292e10.2.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 9.2.dhcpmon.exe.4362e10.1.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.dhcpmon.exe.4362e10.1.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.dhcpmon.exe.3fcb7a6.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.3fcb7a6.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.343ca68.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.343ca68.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 9.2.dhcpmon.exe.4362e10.1.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 7.2.dhcpmon.exe.4292e10.2.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 14.2.dhcpmon.exe.3fcb7a6.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a705dc.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a705dc.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.dhcpmon.exe.3fd4c05.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.3fd4c05.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.5940000.7.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.5940000.7.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4464c05.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4464c05.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.2a89714.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.2a89714.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.44605dc.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.44605dc.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6890000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6890000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.44605dc.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.44605dc.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.dhcpmon.exe.42205dc.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.42205dc.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6894629.11.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6894629.11.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a705dc.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a705dc.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.dhcpmon.exe.421b7a6.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.421b7a6.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.dhcpmon.exe.421b7a6.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.445b7a6.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.445b7a6.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.445b7a6.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.2a4cd70.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.2a4cd70.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6890000.10.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6890000.10.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.dhcpmon.exe.3fd05dc.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 14.2.dhcpmon.exe.3fd05dc.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.dhcpmon.exe.4292e10.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.dhcpmon.exe.4292e10.2.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.406c9c0.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.406c9c0.2.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.dhcpmon.exe.4362e10.1.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.dhcpmon.exe.4362e10.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 7.2.dhcpmon.exe.41bc9c0.1.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.dhcpmon.exe.41bc9c0.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.dhcpmon.exe.428c9c0.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.dhcpmon.exe.428c9c0.2.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.424c9c0.1.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.424c9c0.1.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dhcpmon.exe.1.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000003.214715437.000000000606D000.00000004.00000001.sdmp Binary or memory string: 0s.slnt
Source: classification engine Classification label: mal100.troj.evad.winEXE@20/8@7/2
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe File created: C:\Program Files (x86)\DHCP Monitor Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cd61fe0ebfe9f6326cd5a4df9747e72c.exe.log Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\{25d2fcba-c6f2-4766-acfe-f43fa2f1c231}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5772:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5872:120:WilError_01
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe File created: C:\Users\user\AppData\Local\Temp\tmp8193.tmp Jump to behavior
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe File read: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe 'C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe'
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process created: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe {path}
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp8193.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp84B1.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe 0
Source: unknown Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Source: unknown Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process created: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process created: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe {path} Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp8193.tmp' Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp84B1.tmp' Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process created: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe {path} Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path} Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path} Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path} Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: dows\dll\mscorlib.pdbGk source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.483797356.00000000015D2000.00000004.00000020.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_015B6BB9 push 1405566Ah; ret 0_2_015B6BC5
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02EC2C42 push edx; iretd 0_2_02EC2C43
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02EC9DAB pushad ; ret 0_2_02EC9DB9
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 1_2_058969F8 pushad ; retf 1_2_058969F9
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 1_2_058969FB push esp; retf 1_2_05896A01
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_01364101 push ecx; iretd 6_2_01364102
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_013641FB push ebp; iretd 6_2_01364202
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_013641C1 push esp; iretd 6_2_013641C2
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_013640C3 push eax; iretd 6_2_013640CA
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_013640C1 push eax; iretd 6_2_013640C2
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_013642B1 push esi; iretd 6_2_013642B2
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_01364537 push edi; iretd 6_2_0136453A
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_0136453B push edi; iretd 6_2_01364542
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_01364471 push edi; iretd 6_2_01364472
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_013644F0 push edi; iretd 6_2_013644F2
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_0136B361 pushfd ; iretd 6_2_0136B362
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_0136B251 pushfd ; iretd 6_2_0136B252
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_0136B2A8 pushfd ; iretd 6_2_0136B2AA
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_0136B413 pushfd ; iretd 6_2_0136B416
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C3CAC4 pushad ; ret 6_2_02C3CACD
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C322D7 push ds; ret 6_2_02C322EA
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C35AF3 push ebp; ret 6_2_02C35AFA
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C3225B push ds; ret 6_2_02C3225E
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C35387 push ecx; ret 6_2_02C3538E
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C35B47 push ebp; ret 6_2_02C35B4E
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C35B57 push esi; ret 6_2_02C35B5E
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C35B5F push esp; ret 6_2_02C35B2A
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C35360 push ebx; ret 6_2_02C35362
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C3536B push ecx; ret 6_2_02C3536E
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C3536F push ecx; ret 6_2_02C35372
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 6_2_02C35373 push ebx; ret 6_2_02C3537A
Source: initial sample Static PE information: section name: .text entropy: 7.37345059392
Source: initial sample Static PE information: section name: .text entropy: 7.37345059392
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Jump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp8193.tmp'

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe File opened: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 3156, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 6124, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5644, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5932, type: MEMORY
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.234444553.00000000030E1000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.271289250.0000000002F01000.00000004.00000001.sdmp, dhcpmon.exe, 00000007.00000002.271593966.0000000003051000.00000004.00000001.sdmp, dhcpmon.exe, 00000009.00000002.292078736.0000000003121000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.234444553.00000000030E1000.00000004.00000001.sdmp, cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.271289250.0000000002F01000.00000004.00000001.sdmp, dhcpmon.exe, 00000007.00000002.271593966.0000000003051000.00000004.00000001.sdmp, dhcpmon.exe, 00000009.00000002.292078736.0000000003121000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Contains capabilities to detect virtual machines
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Window / User API: threadDelayed 7326 Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Window / User API: threadDelayed 1968 Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Window / User API: foregroundWindowGot 855 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe TID: 5680 Thread sleep time: -31500s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe TID: 5648 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe TID: 5904 Thread sleep time: -9223372036854770s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe TID: 6056 Thread sleep time: -31500s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe TID: 4952 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4220 Thread sleep time: -31500s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 2436 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 6068 Thread sleep time: -31500s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5880 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe TID: 5044 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5728 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4920 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Thread delayed: delay time: 31500 Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Thread delayed: delay time: 31500 Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 31500 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 31500 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477
Source: dhcpmon.exe, 00000007.00000002.289250340.0000000008861000.00000004.00000001.sdmp Binary or memory string: VMware
Source: dhcpmon.exe, 00000007.00000002.289250340.0000000008861000.00000004.00000001.sdmp Binary or memory string: Win32_VideoController(Standard display types)VMware3UW3EG5WWin32_VideoControllerOKLWC7_2VideoController120060621000000.000000-00078512323display.infMSBDATN6AAWCLPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsSX6PK4_V
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.281654044.000000000E2C0000.00000004.00000001.sdmp Binary or memory string: Win32_VideoController(Standard display types)VMware3UW3EG5WWin32_VideoControllerOKLWC7_2VideoController120060621000000.000000-00078512323display.infMSBDATN6AAWCLPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsSX6PK4_Vl
Source: dhcpmon.exe, 00000009.00000002.292078736.0000000003121000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.491028151.00000000073B0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: dhcpmon.exe, 00000009.00000002.292078736.0000000003121000.00000004.00000001.sdmp Binary or memory string: vmware
Source: dhcpmon.exe, 00000009.00000002.292078736.0000000003121000.00000004.00000001.sdmp Binary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 00000009.00000002.292078736.0000000003121000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 00000009.00000002.292078736.0000000003121000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: dhcpmon.exe, 00000009.00000002.292078736.0000000003121000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: dhcpmon.exe, 00000009.00000002.292078736.0000000003121000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.483866370.000000000163E000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll(V~q
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.491028151.00000000073B0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.491028151.00000000073B0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: dhcpmon.exe, 00000009.00000002.292078736.0000000003121000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: dhcpmon.exe, 00000009.00000002.292078736.0000000003121000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: dhcpmon.exe, 00000009.00000002.292078736.0000000003121000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: dhcpmon.exe, 00000009.00000002.292078736.0000000003121000.00000004.00000001.sdmp Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.249217026.000000000EB60000.00000004.00000001.sdmp Binary or memory string: Win32_VideoController(Standard display types)VMware3UW3EG5WWin32_VideoControllerOKLWC7_2VideoController120060621000000.000000-00078512323display.infMSBDATN6AAWCLPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsSX6PK4_VO
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.491028151.00000000073B0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process token adjusted: Debug Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Memory written: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Memory written: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Memory written: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Memory written: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process created: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe {path} Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp8193.tmp' Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp84B1.tmp' Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Process created: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe {path} Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path} Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path} Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path} Jump to behavior
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.486359950.000000000350D000.00000004.00000001.sdmp Binary or memory string: Program Manager
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.484100244.0000000001CE0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.484100244.0000000001CE0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.484100244.0000000001CE0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe VolumeInformation
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Code function: 0_2_02F42FC8 GetUserNameA, 0_2_02F42FC8
Source: C:\Users\user\Desktop\cd61fe0ebfe9f6326cd5a4df9747e72c.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Nanocore RAT
Source: Yara match File source: 0000000A.00000002.292598003.0000000002A21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.305109543.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.488801787.0000000004459000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.306683734.0000000003F89000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.290898353.00000000031D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.274520141.0000000004059000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.289163047.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.284508167.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.484987240.0000000003411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.291112478.00000000041D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.295474134.0000000004129000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.479870738.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.306608313.0000000002F81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.490630071.0000000006890000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.293253440.0000000003A29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.237161561.00000000040E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.274443364.0000000003F09000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 3468, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 5064, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 3156, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 6124, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5644, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2160, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5932, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2224, type: MEMORY
Source: Yara match File source: 12.2.dhcpmon.exe.42205dc.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fd05dc.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a74c05.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.4224c05.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a6b7a6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.dhcpmon.exe.4292e10.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.dhcpmon.exe.4362e10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fcb7a6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a705dc.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fd4c05.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4464c05.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.44605dc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6890000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.44605dc.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.42205dc.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6894629.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a705dc.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.421b7a6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.445b7a6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6890000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fd05dc.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.dhcpmon.exe.4292e10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.406c9c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.dhcpmon.exe.4362e10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.dhcpmon.exe.41bc9c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.dhcpmon.exe.428c9c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.424c9c0.1.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Detected Nanocore Rat
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000000.00000002.237161561.00000000040E9000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.488801787.0000000004459000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000001.00000002.488801787.0000000004459000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 00000006.00000002.274443364.0000000003F09000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000007.00000002.274520141.0000000004059000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000009.00000002.295474134.0000000004129000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 0000000A.00000002.292598003.0000000002A21000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: cd61fe0ebfe9f6326cd5a4df9747e72c.exe, 0000000A.00000002.292598003.0000000002A21000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 0000000C.00000002.290898353.00000000031D1000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000C.00000002.290898353.00000000031D1000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 0000000E.00000002.305109543.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000E.00000002.306683734.0000000003F89000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Yara detected Nanocore RAT
Source: Yara match File source: 0000000A.00000002.292598003.0000000002A21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.305109543.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.488801787.0000000004459000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.306683734.0000000003F89000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.290898353.00000000031D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.274520141.0000000004059000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.289163047.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.284508167.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.484987240.0000000003411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.291112478.00000000041D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.295474134.0000000004129000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.479870738.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.306608313.0000000002F81000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.490630071.0000000006890000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.293253440.0000000003A29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.237161561.00000000040E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.274443364.0000000003F09000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 3468, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 5064, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 3156, type: MEMORY
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 6124, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5644, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2160, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 5932, type: MEMORY
Source: Yara match File source: Process Memory Space: cd61fe0ebfe9f6326cd5a4df9747e72c.exe PID: 2224, type: MEMORY
Source: Yara match File source: 12.2.dhcpmon.exe.42205dc.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fd05dc.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a74c05.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.4224c05.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a6b7a6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.dhcpmon.exe.4292e10.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.dhcpmon.exe.4362e10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fcb7a6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a705dc.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fd4c05.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4464c05.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.44605dc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6890000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.44605dc.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4142e10.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.42205dc.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6894629.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.3a705dc.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.4322e10.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.dhcpmon.exe.421b7a6.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.445b7a6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.6890000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.dhcpmon.exe.3fd05dc.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.dhcpmon.exe.4292e10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.406c9c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.dhcpmon.exe.4362e10.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.dhcpmon.exe.41bc9c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.dhcpmon.exe.428c9c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.cd61fe0ebfe9f6326cd5a4df9747e72c.exe.424c9c0.1.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 402423 Sample: cd61fe0ebfe9f6326cd5a4df974... Startdate: 03/05/2021 Architecture: WINDOWS Score: 100 53 Multi AV Scanner detection for domain / URL 2->53 55 Found malware configuration 2->55 57 Malicious sample detected (through community Yara rule) 2->57 59 11 other signatures 2->59 8 cd61fe0ebfe9f6326cd5a4df9747e72c.exe 3 2->8         started        12 dhcpmon.exe 3 2->12         started        14 cd61fe0ebfe9f6326cd5a4df9747e72c.exe 2 2->14         started        16 dhcpmon.exe 2 2->16         started        process3 file4 47 cd61fe0ebfe9f6326cd5a4df9747e72c.exe.log, ASCII 8->47 dropped 63 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->63 65 Uses schtasks.exe or at.exe to add and modify task schedules 8->65 67 Injects a PE file into a foreign processes 8->67 18 cd61fe0ebfe9f6326cd5a4df9747e72c.exe 1 12 8->18         started        23 dhcpmon.exe 12->23         started        25 dhcpmon.exe 12->25         started        27 cd61fe0ebfe9f6326cd5a4df9747e72c.exe 14->27         started        29 dhcpmon.exe 16->29         started        signatures5 process6 dnsIp7 49 cloudhost.myfirewall.org 45.154.4.64, 5456 COMBAHTONcombahtonGmbHDE Netherlands 18->49 51 192.168.2.1 unknown unknown 18->51 39 C:\Program Files (x86)\...\dhcpmon.exe, PE32 18->39 dropped 41 C:\Users\user\AppData\Roaming\...\run.dat, data 18->41 dropped 43 C:\Users\user\AppData\Local\...\tmp8193.tmp, XML 18->43 dropped 45 C:\...\dhcpmon.exe:Zone.Identifier, ASCII 18->45 dropped 61 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->61 31 schtasks.exe 1 18->31         started        33 schtasks.exe 1 18->33         started        file8 signatures9 process10 process11 35 conhost.exe 31->35         started        37 conhost.exe 33->37         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
45.154.4.64
 cloudhost.myfirewall.org Netherlands
30823 COMBAHTONcombahtonGmbHDE true

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
cloudhost.myfirewall.org 45.154.4.64 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
cloudhost.myfirewall.org true
  • 8%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown