Analysis Report CONTRACT.exe

Overview

General Information

Sample Name:	CONTRACT.exe
Analysis ID:	431926
MD5:	02430d34be900990fbf6a7efe35a7c64
SHA1:	00b40170c46ae026cf518588d5b6177538bb1036
SHA256:	80ca460c629559cf38e1244983877ed9c041c636c1f2e7e388ae2f9ba4d06788
Tags:	exeNanoCore
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Yara detected AntiVM3

Yara detected Nanocore RAT

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Signatures

AV Detection:

Found malware configuration

Source: 0000001C.00000002.425591629.0000000002CA1000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "30b6fbac-dd0d-47bd-b8ab-6df66b01", "Group": "Default", "Domain1": "kjjuigfdullygigyftkuyluylygilyfidyyuljhd.ydns.eu", "Domain2": "", "Port": 1187, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.415", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\QnctWeFrWlqq.exe

ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: CONTRACT.exe

ReversingLabs: Detection: 36%

Yara detected Nanocore RAT

Source: Yara match	File source: 0000001C.00000000.407344258.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.425591629.0000000002CA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.332389158.000000000D991000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.318659568.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.407937748.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.413143915.00000000045C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.499012397.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.425626395.0000000003CA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.319148029.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.424133299.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.507725412.0000000005B20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.506181931.0000000003DE7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.326212902.00000000046B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CONTRACT.exe PID: 6168, type: MEMORY
Source: Yara match	File source: Process Memory Space: CONTRACT.exe PID: 1388, type: MEMORY
Source: Yara match	File source: 28.0.CONTRACT.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.CONTRACT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.CONTRACT.exe.3ce9cd6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.CONTRACT.exe.5b24629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.CONTRACT.exe.3deeb0c.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CONTRACT.exe.da294b8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.CONTRACT.exe.3cf3135.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.CONTRACT.exe.3de9cd6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.CONTRACT.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.CONTRACT.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.CONTRACT.exe.5b20000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CONTRACT.exe.da294b8.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.CONTRACT.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.CONTRACT.exe.3deeb0c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.CONTRACT.exe.5b20000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.CONTRACT.exe.3ceeb0c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.CONTRACT.exe.3ceeb0c.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.CONTRACT.exe.46be418.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.CONTRACT.exe.46be418.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.CONTRACT.exe.3df3135.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.CONTRACT.exe.400000.0.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\QnctWeFrWlqq.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: CONTRACT.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 15.2.CONTRACT.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 28.0.CONTRACT.exe.400000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 15.0.CONTRACT.exe.400000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 15.2.CONTRACT.exe.5b20000.11.unpack	Avira: Label: TR/NanoCore.fadte
Source: 15.0.CONTRACT.exe.400000.3.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 28.0.CONTRACT.exe.400000.3.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 28.2.CONTRACT.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Compliance:

Uses 32bit PE files

Source: CONTRACT.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\CONTRACT.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source: Malware configuration extractor	URLs:
Source: Malware configuration extractor	URLs: kjjuigfdullygigyftkuyluylygilyfidyyuljhd.ydns.eu

Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: CONTRACT.exe, 00000000.00000003.235560856.0000000005A80000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: CONTRACT.exe, 00000000.00000003.238068775.0000000005A7D000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersb
Source: CONTRACT.exe, 00000000.00000003.319401814.0000000005A70000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: CONTRACT.exe, 00000000.00000003.319401814.0000000005A70000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.come.com
Source: CONTRACT.exe, 00000000.00000003.319401814.0000000005A70000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comion
Source: CONTRACT.exe, 00000000.00000003.319401814.0000000005A70000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: CONTRACT.exe, 00000000.00000003.232678625.0000000005A8B000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: CONTRACT.exe, 00000000.00000003.232678625.0000000005A8B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com8
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000000.00000003.234802969.0000000005AAD000.00000004.00000001.sdmp, CONTRACT.exe, 00000000.00000003.235175021.0000000005A74000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: CONTRACT.exe, 00000000.00000003.235175021.0000000005A74000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: CONTRACT.exe, 00000000.00000003.234859930.0000000005A74000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn1
Source: CONTRACT.exe, 00000000.00000003.234859930.0000000005A74000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnPq
Source: CONTRACT.exe, 00000000.00000003.234802969.0000000005AAD000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnl-g
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: CONTRACT.exe, 00000000.00000003.236218871.0000000005A74000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Cg
Source: CONTRACT.exe, 00000000.00000003.236218871.0000000005A74000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0z
Source: CONTRACT.exe, 00000000.00000003.236218871.0000000005A74000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/ita
Source: CONTRACT.exe, 00000000.00000003.236218871.0000000005A74000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: CONTRACT.exe, 00000000.00000003.236218871.0000000005A74000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/Qg3
Source: CONTRACT.exe, 00000000.00000003.236218871.0000000005A74000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/n
Source: CONTRACT.exe, 00000000.00000003.232678625.0000000005A8B000.00000004.00000001.sdmp, CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: CONTRACT.exe, 00000000.00000003.233856245.0000000005A76000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krl
Source: CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: CONTRACT.exe, 00000000.00000003.232884277.0000000005A8B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comcm
Source: CONTRACT.exe, 00000000.00000003.232943546.0000000005A8B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comnm
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: CONTRACT.exe, 00000000.00000002.330280391.0000000006C82000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.415953147.0000000005C60000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: 0000001C.00000000.407344258.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001C.00000000.407344258.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000002.425591629.0000000002CA1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.332389158.000000000D991000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.332389158.000000000D991000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000F.00000000.318659568.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000F.00000000.318659568.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000000.407937748.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001C.00000000.407937748.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000F.00000002.507246807.0000000005330000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.413143915.00000000045C1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.413143915.00000000045C1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000F.00000002.499012397.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000F.00000002.499012397.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000002.425626395.0000000003CA1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000F.00000000.319148029.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000F.00000000.319148029.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000002.424133299.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001C.00000002.424133299.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000F.00000002.507725412.0000000005B20000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000F.00000002.506181931.0000000003DE7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.326212902.00000000046B1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.326212902.00000000046B1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: CONTRACT.exe PID: 6168, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: CONTRACT.exe PID: 6168, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: CONTRACT.exe PID: 1388, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: CONTRACT.exe PID: 1388, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.0.CONTRACT.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.0.CONTRACT.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.CONTRACT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.CONTRACT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.CONTRACT.exe.3ce9cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.CONTRACT.exe.3ce9cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.CONTRACT.exe.5330000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.CONTRACT.exe.5b24629.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.CONTRACT.exe.3deeb0c.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.CONTRACT.exe.da294b8.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.CONTRACT.exe.da294b8.10.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.CONTRACT.exe.2cc38ec.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.CONTRACT.exe.3cf3135.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.CONTRACT.exe.3de9cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.CONTRACT.exe.3de9cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.0.CONTRACT.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.0.CONTRACT.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.0.CONTRACT.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.0.CONTRACT.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.CONTRACT.exe.5b20000.11.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.CONTRACT.exe.da294b8.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.CONTRACT.exe.da294b8.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.0.CONTRACT.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.0.CONTRACT.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.CONTRACT.exe.3deeb0c.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.CONTRACT.exe.5b20000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.CONTRACT.exe.3ceeb0c.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.CONTRACT.exe.3ceeb0c.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.CONTRACT.exe.46be418.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.CONTRACT.exe.46be418.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.2.CONTRACT.exe.46be418.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.CONTRACT.exe.46be418.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.CONTRACT.exe.3df3135.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.CONTRACT.exe.2db12f4.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.CONTRACT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.CONTRACT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_0504152A NtQuerySystemInformation,		15_2_0504152A
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_050414EF NtQuerySystemInformation,		15_2_050414EF

Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_0320A320	0_2_0320A320
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_03202720	0_2_03202720
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_0320BEA0	0_2_0320BEA0
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_03209EE0	0_2_03209EE0
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_0320B560	0_2_0320B560
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_0320F140	0_2_0320F140
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_0320ADB8	0_2_0320ADB8
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_0320CD98	0_2_0320CD98
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_032059E0	0_2_032059E0
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_03205C48	0_2_03205C48
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_03209858	0_2_03209858
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_032094C8	0_2_032094C8
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_0320DB28	0_2_0320DB28
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_03202710	0_2_03202710
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_0320EB48	0_2_0320EB48
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_032057BF	0_2_032057BF
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_0320EF90	0_2_0320EF90
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_03206247	0_2_03206247
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_03206258	0_2_03206258
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_03205917	0_2_03205917
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_0320ED40	0_2_0320ED40
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_0320E5A0	0_2_0320E5A0
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_0320B998	0_2_0320B998
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_03205C38	0_2_03205C38
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_0320586F	0_2_0320586F
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_0320E840	0_2_0320E840
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_03205841	0_2_03205841
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_032058B1	0_2_032058B1
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_032058CB	0_2_032058CB
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07481758	0_2_07481758
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07481318	0_2_07481318
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07480070	0_2_07480070
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07483690	0_2_07483690
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07481748	0_2_07481748
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07480540	0_2_07480540
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07480550	0_2_07480550
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07482F78	0_2_07482F78
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07483F78	0_2_07483F78
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07480B19	0_2_07480B19
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07481311	0_2_07481311
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07483F28	0_2_07483F28
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07484529	0_2_07484529
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07480B20	0_2_07480B20
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07484538	0_2_07484538
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07481FEC	0_2_07481FEC
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07482F88	0_2_07482F88
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07483F88	0_2_07483F88
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07481A7F	0_2_07481A7F
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07480006	0_2_07480006
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07482006	0_2_07482006
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07482028	0_2_07482028
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07483680	0_2_07483680
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_07481A90	0_2_07481A90
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_04EE3850	15_2_04EE3850
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_04EE86A8	15_2_04EE86A8
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_04EE92A8	15_2_04EE92A8
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_04EE2FA8	15_2_04EE2FA8
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_04EE23A0	15_2_04EE23A0
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_04EEAF31	15_2_04EEAF31
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_04EE306F	15_2_04EE306F
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_04EE95BB	15_2_04EE95BB
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_04EE936F	15_2_04EE936F
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_04EE9B50	15_2_04EE9B50
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_0577B560	18_2_0577B560
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_0577F140	18_2_0577F140
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_057759E0	18_2_057759E0
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_0577ADB8	18_2_0577ADB8
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_0577CD98	18_2_0577CD98
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_05779858	18_2_05779858
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_05775C48	18_2_05775C48
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_057794C8	18_2_057794C8
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_0577A320	18_2_0577A320
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_05772720	18_2_05772720
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_05779EE0	18_2_05779EE0
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_0577BEA0	18_2_0577BEA0
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_0577ED40	18_2_0577ED40
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_057755B1	18_2_057755B1
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_0577E5A0	18_2_0577E5A0
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_0577B998	18_2_0577B998
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_0577E840	18_2_0577E840
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_05775C38	18_2_05775C38
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_057758CB	18_2_057758CB
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_0577EB48	18_2_0577EB48
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_0577DB28	18_2_0577DB28
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_05772710	18_2_05772710
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_0577EF90	18_2_0577EF90
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_05776258	18_2_05776258
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_05776247	18_2_05776247
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F41E0	18_2_071F41E0
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F3610	18_2_071F3610
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F0070	18_2_071F0070
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F1318	18_2_071F1318
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F3918	18_2_071F3918
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F1316	18_2_071F1316
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F3F08	18_2_071F3F08
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F2F38	18_2_071F2F38
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F0B20	18_2_071F0B20
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F1758	18_2_071F1758
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F0550	18_2_071F0550
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F1748	18_2_071F1748
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F0540	18_2_071F0540
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F2F78	18_2_071F2F78
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F2F88	18_2_071F2F88
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F41D1	18_2_071F41D1
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F0006	18_2_071F0006
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F3600	18_2_071F3600
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F2028	18_2_071F2028
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F2026	18_2_071F2026
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F1A41	18_2_071F1A41
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F1640	18_2_071F1640
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F1A7F	18_2_071F1A7F
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F1A90	18_2_071F1A90
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F44B8	18_2_071F44B8
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F44B6	18_2_071F44B6
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F3EA8	18_2_071F3EA8
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F0AC7	18_2_071F0AC7
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F3EF8	18_2_071F3EF8
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_071F0AF1	18_2_071F0AF1
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 28_2_00F82FA8	28_2_00F82FA8
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 28_2_00F823A0	28_2_00F823A0
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 28_2_00F83850	28_2_00F83850
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 28_2_00F8306F	28_2_00F8306F

Source: CONTRACT.exe, 00000000.00000002.320453077.0000000000E70000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamep6FirY.exeR vs CONTRACT.exe
Source: CONTRACT.exe, 00000000.00000002.321826037.0000000001640000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs CONTRACT.exe
Source: CONTRACT.exe, 00000000.00000002.330904879.00000000071D0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs CONTRACT.exe
Source: CONTRACT.exe, 00000000.00000002.331227731.0000000007500000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs CONTRACT.exe
Source: CONTRACT.exe, 00000000.00000002.331227731.0000000007500000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs CONTRACT.exe
Source: CONTRACT.exe, 00000000.00000002.331511150.0000000007640000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs CONTRACT.exe
Source: CONTRACT.exe, 00000000.00000002.328078636.0000000005930000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameWindowsNetwork.dll> vs CONTRACT.exe
Source: CONTRACT.exe, 00000000.00000002.331081001.00000000074A0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs CONTRACT.exe
Source: CONTRACT.exe, 0000000F.00000000.319310047.0000000000710000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamep6FirY.exeR vs CONTRACT.exe
Source: CONTRACT.exe, 0000000F.00000002.507246807.0000000005330000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs CONTRACT.exe
Source: CONTRACT.exe, 0000000F.00000002.506876489.0000000004FF0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs CONTRACT.exe
Source: CONTRACT.exe, 0000000F.00000002.501147747.0000000000D2A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs CONTRACT.exe
Source: CONTRACT.exe, 0000000F.00000002.508210268.00000000063D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs CONTRACT.exe
Source: CONTRACT.exe, 0000000F.00000002.507690875.0000000005B10000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs CONTRACT.exe
Source: CONTRACT.exe, 0000000F.00000002.506181931.0000000003DE7000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs CONTRACT.exe
Source: CONTRACT.exe, 0000000F.00000002.507447877.0000000005710000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs CONTRACT.exe
Source: CONTRACT.exe, 00000012.00000002.417606505.0000000006F50000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs CONTRACT.exe
Source: CONTRACT.exe, 00000012.00000002.418463825.0000000007270000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs CONTRACT.exe
Source: CONTRACT.exe, 00000012.00000002.418463825.0000000007270000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs CONTRACT.exe
Source: CONTRACT.exe, 00000012.00000000.327386760.0000000000FA0000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamep6FirY.exeR vs CONTRACT.exe
Source: CONTRACT.exe, 00000012.00000002.412946319.00000000039A3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameWindowsNetwork.dll> vs CONTRACT.exe
Source: CONTRACT.exe, 00000012.00000002.418259595.0000000007210000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs CONTRACT.exe
Source: CONTRACT.exe, 00000012.00000002.416976159.0000000006C60000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs CONTRACT.exe
Source: CONTRACT.exe, 0000001A.00000002.405851211.00000000004B0000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamep6FirY.exeR vs CONTRACT.exe
Source: CONTRACT.exe, 0000001C.00000002.424334425.00000000005B0000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamep6FirY.exeR vs CONTRACT.exe
Source: CONTRACT.exe, 0000001C.00000002.425591629.0000000002CA1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs CONTRACT.exe
Source: CONTRACT.exe, 0000001C.00000002.425591629.0000000002CA1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs CONTRACT.exe
Source: CONTRACT.exe, 0000001C.00000002.424932741.0000000000CBA000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs CONTRACT.exe
Source: CONTRACT.exe, 0000001C.00000002.425626395.0000000003CA1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs CONTRACT.exe
Source: CONTRACT.exe, 0000001C.00000002.425752443.0000000004DD0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs CONTRACT.exe
Source: CONTRACT.exe	Binary or memory string: OriginalFilenamep6FirY.exeR vs CONTRACT.exe

Source: 15.2.CONTRACT.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 15.2.CONTRACT.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.2.CONTRACT.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 15.0.CONTRACT.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 15.0.CONTRACT.exe.400000.1.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.0.CONTRACT.exe.400000.1.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 15.0.CONTRACT.exe.400000.3.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 15.0.CONTRACT.exe.400000.3.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 15.0.CONTRACT.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 15.0.CONTRACT.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 15.0.CONTRACT.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 15.2.CONTRACT.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 15.2.CONTRACT.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 28.0.CONTRACT.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 28.0.CONTRACT.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 15.0.CONTRACT.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 15.0.CONTRACT.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 28.0.CONTRACT.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 28.0.CONTRACT.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 28.2.CONTRACT.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 28.2.CONTRACT.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_050412EA AdjustTokenPrivileges,	15_2_050412EA
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_050412B3 AdjustTokenPrivileges,	15_2_050412B3
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_05C319CE AdjustTokenPrivileges,	18_2_05C319CE
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_05C31997 AdjustTokenPrivileges,	18_2_05C31997

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4740:120:WilError_01
Source: C:\Users\user\Desktop\CONTRACT.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\Desktop\CONTRACT.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{30b6fbac-dd0d-47bd-b8ab-6df66b017896}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6236:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6468:120:WilError_01

Source: C:\Users\user\Desktop\CONTRACT.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\CONTRACT.exe 'C:\Users\user\Desktop\CONTRACT.exe'
Source: C:\Users\user\Desktop\CONTRACT.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\QnctWeFrWlqq' /XML 'C:\Users\user\AppData\Local\Temp\tmp99D6.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\CONTRACT.exe	Process created: C:\Users\user\Desktop\CONTRACT.exe {path}
Source: C:\Users\user\Desktop\CONTRACT.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpA9F3.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\CONTRACT.exe C:\Users\user\Desktop\CONTRACT.exe 0
Source: C:\Users\user\Desktop\CONTRACT.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\QnctWeFrWlqq' /XML 'C:\Users\user\AppData\Local\Temp\tmp372F.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\CONTRACT.exe	Process created: C:\Users\user\Desktop\CONTRACT.exe {path}
Source: C:\Users\user\Desktop\CONTRACT.exe	Process created: C:\Users\user\Desktop\CONTRACT.exe {path}
Source: C:\Users\user\Desktop\CONTRACT.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\QnctWeFrWlqq' /XML 'C:\Users\user\AppData\Local\Temp\tmp99D6.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process created: C:\Users\user\Desktop\CONTRACT.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpA9F3.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\QnctWeFrWlqq' /XML 'C:\Users\user\AppData\Local\Temp\tmp372F.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process created: C:\Users\user\Desktop\CONTRACT.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process created: C:\Users\user\Desktop\CONTRACT.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_00D78794 push 28700002h; retn 0000h	0_2_00D789D9
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_00D77076 push ebp; iretd	0_2_00D77077
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 0_2_03202D94 push dword ptr [ecx]; retf	0_2_03202D9C
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_00617076 push ebp; iretd	15_2_00617077
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_00618794 push 28700002h; retn 0000h	15_2_006189D9
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_00CE74AC push ecx; ret	15_2_00CE74AD
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_00CE74B8 push ebp; ret	15_2_00CE74B9
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_00CE9D58 pushad ; retf	15_2_00CE9D59
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_00CE9D54 push eax; retf	15_2_00CE9D55
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_00EA8794 push 28700002h; retn 0000h	18_2_00EA89D9
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_00EA7076 push ebp; iretd	18_2_00EA7077
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 18_2_05772D94 push dword ptr [ecx]; retf	18_2_05772D9C
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 26_2_003B7076 push ebp; iretd	26_2_003B7077
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 26_2_003B8794 push 28700002h; retn 0000h	26_2_003B89D9
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 28_2_004B7076 push ebp; iretd	28_2_004B7077
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 28_2_004B8794 push 28700002h; retn 0000h	28_2_004B89D9

Source: initial sample	Static PE information: section name: .text entropy: 7.29376967447
Source: initial sample	Static PE information: section name: .text entropy: 7.29376967447

Source: 15.2.CONTRACT.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 15.2.CONTRACT.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 15.0.CONTRACT.exe.400000.1.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 15.0.CONTRACT.exe.400000.1.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 15.0.CONTRACT.exe.400000.3.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 15.0.CONTRACT.exe.400000.3.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 28.0.CONTRACT.exe.400000.1.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 28.0.CONTRACT.exe.400000.1.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 28.0.CONTRACT.exe.400000.3.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 28.0.CONTRACT.exe.400000.3.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 28.2.CONTRACT.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 28.2.CONTRACT.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: CONTRACT.exe, 00000000.00000002.323016759.00000000036B1000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.412160555.00000000035F3000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: CONTRACT.exe, 00000000.00000002.323016759.00000000036B1000.00000004.00000001.sdmp, CONTRACT.exe, 00000012.00000002.412160555.00000000035F3000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\CONTRACT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\CONTRACT.exe TID: 6376	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe TID: 3596	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe TID: 3596	Thread sleep count: 132 > 30	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe TID: 3596	Thread sleep count: 210 > 30	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe TID: 4532	Thread sleep count: 143 > 30	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe TID: 5804	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe TID: 4696	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe TID: 7152	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Analysis Report CONTRACT.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Source: CONTRACT.exe, 00000012.00000002.412160555.00000000035F3000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: CONTRACT.exe, 0000000F.00000002.508210268.00000000063D0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: CONTRACT.exe, 00000012.00000002.412160555.00000000035F3000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: CONTRACT.exe, 00000012.00000002.412160555.00000000035F3000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: CONTRACT.exe, 00000012.00000002.412160555.00000000035F3000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: CONTRACT.exe, 0000000F.00000002.501442796.0000000000DAD000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: CONTRACT.exe, 00000012.00000002.412160555.00000000035F3000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: CONTRACT.exe, 00000012.00000002.412160555.00000000035F3000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: CONTRACT.exe, 0000000F.00000002.508210268.00000000063D0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: CONTRACT.exe, 0000000F.00000002.508210268.00000000063D0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: CONTRACT.exe, 00000012.00000002.412160555.00000000035F3000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: CONTRACT.exe, 00000012.00000002.412160555.00000000035F3000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: CONTRACT.exe, 00000012.00000002.412160555.00000000035F3000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: CONTRACT.exe, 0000000F.00000002.501442796.0000000000DAD000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: CONTRACT.exe, 0000000F.00000002.508210268.00000000063D0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\CONTRACT.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\CONTRACT.exe	Memory written: C:\Users\user\Desktop\CONTRACT.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\Desktop\CONTRACT.exe	Memory written: C:\Users\user\Desktop\CONTRACT.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: CONTRACT.exe, 0000000F.00000002.501442796.0000000000DAD000.00000004.00000020.sdmp	Binary or memory string: Program Manager
Source: CONTRACT.exe, 0000000F.00000002.502050466.0000000001470000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: CONTRACT.exe, 0000000F.00000002.502050466.0000000001470000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: CONTRACT.exe, 0000000F.00000002.502050466.0000000001470000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: CONTRACT.exe, 0000000F.00000002.501356514.0000000000D99000.00000004.00000020.sdmp	Binary or memory string: sProgram ManagerD[
Source: CONTRACT.exe, 0000000F.00000002.502050466.0000000001470000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: CONTRACT.exe, 0000000F.00000002.502050466.0000000001470000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: CONTRACT.exe, 0000000F.00000002.505011573.0000000002E5C000.00000004.00000001.sdmp	Binary or memory string: Program Manager8V
Source: CONTRACT.exe, 0000000F.00000002.501442796.0000000000DAD000.00000004.00000020.sdmp	Binary or memory string: Program Manager\

Source: CONTRACT.exe, 0000000F.00000000.318659568.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: CONTRACT.exe, 0000000F.00000002.507246807.0000000005330000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: CONTRACT.exe, 0000001C.00000000.407344258.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: CONTRACT.exe, 0000001C.00000002.425591629.0000000002CA1000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_0504283A bind,		15_2_0504283A
Source: C:\Users\user\Desktop\CONTRACT.exe	Code function: 15_2_050427E8 bind,		15_2_050427E8

Name	IP	Active
api.globalsign.cloud	104.18.24.243	true
kjjuigfdullygigyftkuyluylygilyfidyyuljhd.ydns.eu	185.140.53.135	true

Name	Malicious	Antivirus Detection	Reputation
	true	Avira URL Cloud: safe	low
kjjuigfdullygigyftkuyluylygilyfidyyuljhd.ydns.eu	true	Avira URL Cloud: safe	unknown

ID:	431926
Product:	CloudBasic
Start time:	15:09:58
Start date:	09.06.2021
Sample:	CONTRACT.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	02430d34be900990fbf6a7efe35a7c64
SHA1:	00b40170c46ae026cf518588d5b6177538bb1036
SHA256:	80ca460c629559cf38e1244983877ed9c041c636c1f2e7e388ae2f9ba4d06788
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\CONTRACT.exe.log	ASCII text, with CRLF line terminators	61CCF53571C9ABA6511D696CB0D32E45	A13A42A20EC14942F52DB20FB16A0A520F8183CE	3459BDF6C0B7F9D43649ADAAF19BA8D5D133BCBE5EF80CF4B7000DC91E10903B
C:\Users\user\AppData\Local\Temp\tmp372F.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	079FD1EAE59C41272B433990C9FE9362	8174889EC1A3B212D32B07674D2AF7277FAF3C36	E7338DDD51F1164DD1D8EAAAA577AFF2D4CEED3E7E878977ED7810EE7FD272BB
C:\Users\user\AppData\Local\Temp\tmp99D6.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	079FD1EAE59C41272B433990C9FE9362	8174889EC1A3B212D32B07674D2AF7277FAF3C36	E7338DDD51F1164DD1D8EAAAA577AFF2D4CEED3E7E878977ED7810EE7FD272BB
C:\Users\user\AppData\Local\Temp\tmpA9F3.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	3D40480D97364F56C5C51E071E631CCA	E13D848FFA6CC8296CE19F5D3D6018AC500AB54E	FEBB7C115CF69F8959CF4F0B5BD15FC3AF198E93F7ED32937DBCD2B8D1086B99
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat	Non-ISO extended-ASCII text, with NEL line terminators	B75FA3BA49F18EFFCA05BC26EFC182E4	170FAB6DBDBBD728DB71E9DFA17A74CFDBB80E18	25EBD16688D06225015F798E1ED5801A7DF0D12E9587A5B4421C3B7563514189
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat	ASCII text, with no line terminators	DBCC846B014C265EDEF56251371453F9	9C5B51D9F562B065CDBFC598D46A2757BE06BDD5	82DDF51FD8DAEA1C6A369F221EDEB9EA74FC17C3DDC03F8C6DD7B3DCCCFD1CC7
C:\Users\user\AppData\Roaming\QnctWeFrWlqq.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	02430D34BE900990FBF6A7EFE35A7C64	00B40170C46AE026CF518588D5B6177538BB1036	80CA460C629559CF38E1244983877ED9C041C636C1F2E7E388AE2F9BA4D06788