Play interactive tour

Edit tour

Analysis Report 20014464370.PDF.exe

Overview

General Information

Sample Name:	20014464370.PDF.exe
Analysis ID:	432418
MD5:	cac542cd84be91ea0acfb9cd1964397d
SHA1:	339d543a12e1f849bfe14a71c4a05106380548ab
SHA256:	49c28c9ab46c71450929ffc850dc411cf24f125659cc253f0ee5fb16a59e3f7f
Tags:	exeNanoCore
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Nanocore RAT

.NET source code contains potential unpacker

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses an obfuscated file name to hide its real file extension (double extension)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Abnormal high CPU Usage

Antivirus or Machine Learning detection for unpacked file

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

20014464370.PDF.exe (PID: 5480 cmdline: 'C:\Users\user\Desktop\20014464370.PDF.exe' MD5: CAC542CD84BE91EA0ACFB9CD1964397D)

RegAsm.exe (PID: 5612 cmdline: C:\Users\user\AppData\Local\Temp\RegAsm.exe gyujnbgh MD5: 6FD7592411112729BF6B1F2F6C34899F)

AAAstarupxxzzzgb.exe (PID: 3604 cmdline: 'C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe' MD5: C7330A70647D84A218BBE2E6D245DCE3)

lkjhgfs.exe (PID: 1848 cmdline: 'C:\Users\user\AppData\Local\lkjhgfs.exe' MD5: CAC542CD84BE91EA0ACFB9CD1964397D)

RegAsm.exe (PID: 964 cmdline: C:\Users\user\AppData\Local\Temp\RegAsm.exe gyujnbgh MD5: 6FD7592411112729BF6B1F2F6C34899F)

lkjhgfs.exe (PID: 5188 cmdline: 'C:\Users\user\AppData\Local\lkjhgfs.exe' MD5: CAC542CD84BE91EA0ACFB9CD1964397D)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "ba5f434c-3370-4fb7-bec8-4c7f593d", "Group": "Grace", "Domain1": "23.105.131.142", "Domain2": "startedhere.ddns.net", "Port": 2092, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Disable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Disable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
20014464370.PDF.exe	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
C:\Users\user\AppData\Local\lkjhgfs.exe	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.508404585.0000000005220000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x16e3:$x1: NanoCore.ClientPluginHost 0x171c:$x2: IClientNetworkHost
0000000C.00000002.508404585.0000000005220000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x16e3:$x2: NanoCore.ClientPluginHost 0x1800:$s4: PipeCreated 0x16fd:$s5: IClientLoggingHost
0000000C.00000002.509028437.0000000006560000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x350b:$x1: NanoCore.ClientPluginHost 0x3525:$x2: IClientNetworkHost
0000000C.00000002.509028437.0000000006560000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x350b:$x2: NanoCore.ClientPluginHost 0x52b6:$s4: PipeCreated 0x34f8:$s5: IClientLoggingHost
00000017.00000000.484413891.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000017.00000000.484413891.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000017.00000000.484413891.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x919a5:$x1: NanoCore.ClientPluginHost 0x919e2:$x2: IClientNetworkHost 0x95515:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x9170d:$a: NanoCore 0x9171d:$a: NanoCore 0x91951:$a: NanoCore 0x91965:$a: NanoCore 0x919a5:$a: NanoCore 0x9176c:$b: ClientPlugin 0x9196e:$b: ClientPlugin 0x919ae:$b: ClientPlugin 0x91893:$c: ProjectData 0x9229a:$d: DESCrypto 0x99c66:$e: KeepAlive 0x97c54:$g: LogClientMessage 0x93e4f:$i: get_Connected 0x925d0:$j: #=q 0x92600:$j: #=q 0x9261c:$j: #=q 0x9264c:$j: #=q 0x92668:$j: #=q 0x92684:$j: #=q 0x926b4:$j: #=q 0x926d0:$j: #=q
0000000C.00000002.508963267.0000000006520000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x59eb:$x1: NanoCore.ClientPluginHost 0x5b48:$x2: IClientNetworkHost
0000000C.00000002.508963267.0000000006520000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x59eb:$x2: NanoCore.ClientPluginHost 0x6941:$s3: PipeExists 0x5be1:$s4: PipeCreated 0x5a05:$s5: IClientLoggingHost
0000000C.00000002.508342634.00000000051F0000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4bbb:$x1: NanoCore.ClientPluginHost 0x4be5:$x2: IClientNetworkHost
0000000C.00000002.508342634.00000000051F0000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x4bbb:$x2: NanoCore.ClientPluginHost 0x6a6b:$s4: PipeCreated
0000000C.00000002.508356430.0000000005200000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8ba5:$x1: NanoCore.ClientPluginHost 0x8bd2:$x2: IClientNetworkHost
0000000C.00000002.508356430.0000000005200000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x8ba5:$x2: NanoCore.ClientPluginHost 0x9b74:$s2: FileCommand 0xe576:$s4: PipeCreated 0x8bbf:$s5: IClientLoggingHost
00000011.00000000.377243556.0000000000542000.00000002.00020000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000017.00000002.498671862.0000000002DA1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000017.00000002.498671862.0000000002DA1000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6944f:$a: NanoCore 0x694a8:$a: NanoCore 0x694e5:$a: NanoCore 0x6955e:$a: NanoCore 0x694b1:$b: ClientPlugin 0x694ee:$b: ClientPlugin 0x69dec:$b: ClientPlugin 0x69df9:$b: ClientPlugin 0x5f0aa:$e: KeepAlive 0x69939:$g: LogClientMessage 0x698b9:$i: get_Connected 0x59885:$j: #=q 0x598b5:$j: #=q 0x598f1:$j: #=q 0x59919:$j: #=q 0x59949:$j: #=q 0x59979:$j: #=q 0x599a9:$j: #=q 0x599d9:$j: #=q 0x599f5:$j: #=q 0x59a25:$j: #=q
0000000F.00000000.359197318.00000000007B2000.00000002.00020000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000C.00000002.508139093.0000000004F80000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
0000000C.00000002.508139093.0000000004F80000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
0000000C.00000002.508139093.0000000004F80000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000F.00000002.489565052.0000000003E8E000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10875:$x1: NanoCore.ClientPluginHost 0x108b2:$x2: IClientNetworkHost 0x143e5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000F.00000002.489565052.0000000003E8E000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000F.00000002.489565052.0000000003E8E000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x105dd:$a: NanoCore 0x105ed:$a: NanoCore 0x10821:$a: NanoCore 0x10835:$a: NanoCore 0x10875:$a: NanoCore 0x1063c:$b: ClientPlugin 0x1083e:$b: ClientPlugin 0x1087e:$b: ClientPlugin 0x10763:$c: ProjectData 0x1116a:$d: DESCrypto 0x18b36:$e: KeepAlive 0x16b24:$g: LogClientMessage 0x12d1f:$i: get_Connected 0x114a0:$j: #=q 0x114d0:$j: #=q 0x114ec:$j: #=q 0x1151c:$j: #=q 0x11538:$j: #=q 0x11554:$j: #=q 0x11584:$j: #=q 0x115a0:$j: #=q
00000011.00000002.499016642.00000000029A0000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2e5899:$x1: NanoCore.ClientPluginHost 0x2e58d6:$x2: IClientNetworkHost 0x2e9409:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000011.00000002.499016642.00000000029A0000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2e5601:$a: NanoCore 0x2e5611:$a: NanoCore 0x2e5845:$a: NanoCore 0x2e5859:$a: NanoCore 0x2e5899:$a: NanoCore 0x2e5660:$b: ClientPlugin 0x2e5862:$b: ClientPlugin 0x2e58a2:$b: ClientPlugin 0x2e5787:$c: ProjectData 0x2e618e:$d: DESCrypto 0x2e7d43:$i: get_Connected 0x2e64c4:$j: #=q 0x2e64f4:$j: #=q 0x2e6510:$j: #=q 0x2e6540:$j: #=q 0x2e655c:$j: #=q 0x2e6578:$j: #=q 0x2e65a8:$j: #=q 0x2e65c4:$j: #=q 0x2e6608:$j: #=q 0x2e6624:$j: #=q
00000011.00000002.504178420.0000000003C2E000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10875:$x1: NanoCore.ClientPluginHost 0x108b2:$x2: IClientNetworkHost 0x143e5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000011.00000002.504178420.0000000003C2E000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000011.00000002.504178420.0000000003C2E000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x105dd:$a: NanoCore 0x105ed:$a: NanoCore 0x10821:$a: NanoCore 0x10835:$a: NanoCore 0x10875:$a: NanoCore 0x1063c:$b: ClientPlugin 0x1083e:$b: ClientPlugin 0x1087e:$b: ClientPlugin 0x10763:$c: ProjectData 0x1116a:$d: DESCrypto 0x18b36:$e: KeepAlive 0x16b24:$g: LogClientMessage 0x12d1f:$i: get_Connected 0x114a0:$j: #=q 0x114d0:$j: #=q 0x114ec:$j: #=q 0x1151c:$j: #=q 0x11538:$j: #=q 0x11554:$j: #=q 0x11584:$j: #=q 0x115a0:$j: #=q
0000000F.00000002.486837759.0000000002C00000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb9999:$x1: NanoCore.ClientPluginHost 0xb99d6:$x2: IClientNetworkHost 0xbd509:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000F.00000002.486837759.0000000002C00000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xb9701:$a: NanoCore 0xb9711:$a: NanoCore 0xb9945:$a: NanoCore 0xb9959:$a: NanoCore 0xb9999:$a: NanoCore 0xb9760:$b: ClientPlugin 0xb9962:$b: ClientPlugin 0xb99a2:$b: ClientPlugin 0xb9887:$c: ProjectData 0xba28e:$d: DESCrypto 0xbbe43:$i: get_Connected 0xba5c4:$j: #=q 0xba5f4:$j: #=q 0xba610:$j: #=q 0xba640:$j: #=q 0xba65c:$j: #=q 0xba678:$j: #=q 0xba6a8:$j: #=q 0xba6c4:$j: #=q 0xba708:$j: #=q 0xba724:$j: #=q
00000001.00000002.341859487.0000000003161000.00000004.00000001.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000C.00000000.340662970.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000000.340662970.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.340662970.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2c89b:$a: NanoCore 0x2c8f4:$a: NanoCore 0x2c931:$a: NanoCore 0x2c9aa:$a: NanoCore 0x8892a:$a: NanoCore 0x8894f:$a: NanoCore 0x889a8:$a: NanoCore 0x98b5b:$a: NanoCore 0x98b81:$a: NanoCore 0x98bdd:$a: NanoCore 0xa5a43:$a: NanoCore 0xa5a9c:$a: NanoCore 0xa5acf:$a: NanoCore 0xa5cfb:$a: NanoCore 0xa5d77:$a: NanoCore 0xa6390:$a: NanoCore 0xa64d9:$a: NanoCore 0xa69ad:$a: NanoCore 0xa6c94:$a: NanoCore 0xa6cab:$a: NanoCore 0xafb5b:$a: NanoCore
0000000C.00000000.339849220.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000000.339849220.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.339849220.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000017.00000002.493387609.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000017.00000002.493387609.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000017.00000002.493387609.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000011.00000002.493302996.0000000000542000.00000002.00020000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000016.00000002.497639798.0000000002441000.00000004.00000001.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000016.00000002.493379288.0000000000052000.00000002.00020000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000001.00000000.218918618.0000000000E12000.00000002.00020000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000F.00000002.486775398.0000000002BB1000.00000004.00000001.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000F.00000002.485697797.00000000007B2000.00000002.00020000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000C.00000002.508978041.0000000006530000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x39eb:$x1: NanoCore.ClientPluginHost 0x3a24:$x2: IClientNetworkHost
0000000C.00000002.508978041.0000000006530000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x39eb:$x2: NanoCore.ClientPluginHost 0x3b36:$s4: PipeCreated 0x3a05:$s5: IClientLoggingHost
0000000C.00000002.508467673.0000000005250000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2205:$x1: NanoCore.ClientPluginHost 0x223e:$x2: IClientNetworkHost
0000000C.00000002.508467673.0000000005250000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2205:$x2: NanoCore.ClientPluginHost 0x2320:$s4: PipeCreated 0x221f:$s5: IClientLoggingHost
0000000C.00000002.504714336.000000000432F000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.504714336.000000000432F000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x16e1:$a: NanoCore 0x173a:$a: NanoCore 0x1777:$a: NanoCore 0x17f0:$a: NanoCore 0x14e9b:$a: NanoCore 0x14eb0:$a: NanoCore 0x14ee5:$a: NanoCore 0x22afa:$a: NanoCore 0x22b1f:$a: NanoCore 0x22b78:$a: NanoCore 0x32d15:$a: NanoCore 0x32d3b:$a: NanoCore 0x32d97:$a: NanoCore 0x3fbec:$a: NanoCore 0x3fc45:$a: NanoCore 0x3fc78:$a: NanoCore 0x3fea4:$a: NanoCore 0x3ff20:$a: NanoCore 0x40539:$a: NanoCore 0x40682:$a: NanoCore 0x40b56:$a: NanoCore
00000016.00000000.453300542.0000000000052000.00000002.00020000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000017.00000002.498968741.0000000003DA9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000017.00000002.498968741.0000000003DA9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x42f0d:$a: NanoCore 0x42f66:$a: NanoCore 0x42fa3:$a: NanoCore 0x4301c:$a: NanoCore 0x566c7:$a: NanoCore 0x566dc:$a: NanoCore 0x56711:$a: NanoCore 0x6f193:$a: NanoCore 0x6f1a8:$a: NanoCore 0x6f1dd:$a: NanoCore 0x42f6f:$b: ClientPlugin 0x42fac:$b: ClientPlugin 0x438aa:$b: ClientPlugin 0x438b7:$b: ClientPlugin 0x56483:$b: ClientPlugin 0x5649e:$b: ClientPlugin 0x564ce:$b: ClientPlugin 0x566e5:$b: ClientPlugin 0x5671a:$b: ClientPlugin 0x6ef4f:$b: ClientPlugin 0x6ef6a:$b: ClientPlugin
0000000C.00000002.508108370.0000000004F70000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
0000000C.00000002.508108370.0000000004F70000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
0000000C.00000002.509043380.0000000006570000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1f1db:$x1: NanoCore.ClientPluginHost 0x1f1f5:$x2: IClientNetworkHost
0000000C.00000002.509043380.0000000006570000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1f1db:$x2: NanoCore.ClientPluginHost 0x22518:$s4: PipeCreated 0x1f1c8:$s5: IClientLoggingHost
00000011.00000002.504008398.0000000003B8F000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x37835:$x1: NanoCore.ClientPluginHost 0x5f855:$x1: NanoCore.ClientPluginHost 0x37872:$x2: IClientNetworkHost 0x5f892:$x2: IClientNetworkHost 0x3b3a5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x633c5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000011.00000002.504008398.0000000003B8F000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000011.00000002.504008398.0000000003B8F000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3759d:$a: NanoCore 0x375ad:$a: NanoCore 0x377e1:$a: NanoCore 0x377f5:$a: NanoCore 0x37835:$a: NanoCore 0x5f5bd:$a: NanoCore 0x5f5cd:$a: NanoCore 0x5f801:$a: NanoCore 0x5f815:$a: NanoCore 0x5f855:$a: NanoCore 0x375fc:$b: ClientPlugin 0x377fe:$b: ClientPlugin 0x3783e:$b: ClientPlugin 0x5f61c:$b: ClientPlugin 0x5f81e:$b: ClientPlugin 0x5f85e:$b: ClientPlugin 0x37723:$c: ProjectData 0x5f743:$c: ProjectData 0x3812a:$d: DESCrypto 0x6014a:$d: DESCrypto 0x3faf6:$e: KeepAlive
00000001.00000002.342734107.00000000042DD000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x37bd5:$x1: NanoCore.ClientPluginHost 0x5fbf5:$x1: NanoCore.ClientPluginHost 0x37c12:$x2: IClientNetworkHost 0x5fc32:$x2: IClientNetworkHost 0x3b745:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x63765:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000002.342734107.00000000042DD000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000002.342734107.00000000042DD000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3793d:$a: NanoCore 0x3794d:$a: NanoCore 0x37b81:$a: NanoCore 0x37b95:$a: NanoCore 0x37bd5:$a: NanoCore 0x5f95d:$a: NanoCore 0x5f96d:$a: NanoCore 0x5fba1:$a: NanoCore 0x5fbb5:$a: NanoCore 0x5fbf5:$a: NanoCore 0x3799c:$b: ClientPlugin 0x37b9e:$b: ClientPlugin 0x37bde:$b: ClientPlugin 0x5f9bc:$b: ClientPlugin 0x5fbbe:$b: ClientPlugin 0x5fbfe:$b: ClientPlugin 0x37ac3:$c: ProjectData 0x5fae3:$c: ProjectData 0x384ca:$d: DESCrypto 0x604ea:$d: DESCrypto 0x3fe96:$e: KeepAlive
0000000C.00000002.503817122.0000000003FFE000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.503817122.0000000003FFE000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xb3f87:$a: NanoCore 0xb3fac:$a: NanoCore 0xb4005:$a: NanoCore 0xc41a4:$a: NanoCore 0xc41ca:$a: NanoCore 0xc4226:$a: NanoCore 0xd107d:$a: NanoCore 0xd10d6:$a: NanoCore 0xd1109:$a: NanoCore 0xd1335:$a: NanoCore 0xd13b1:$a: NanoCore 0xd19ca:$a: NanoCore 0xd1b13:$a: NanoCore 0xd1fe7:$a: NanoCore 0xd22ce:$a: NanoCore 0xd22e5:$a: NanoCore 0xdb189:$a: NanoCore 0xdb205:$a: NanoCore 0xddae8:$a: NanoCore 0xe30b1:$a: NanoCore 0xe312b:$a: NanoCore
0000000C.00000002.508990820.0000000006540000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x5b99:$x1: NanoCore.ClientPluginHost 0x5bb3:$x2: IClientNetworkHost
0000000C.00000002.508990820.0000000006540000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x5b99:$x2: NanoCore.ClientPluginHost 0x6bce:$s4: PipeCreated 0x5b86:$s5: IClientLoggingHost
00000017.00000000.485173449.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000017.00000000.485173449.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000017.00000000.485173449.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000002.503247081.0000000003731000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.503247081.0000000003731000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4af0d:$a: NanoCore 0x4af66:$a: NanoCore 0x4afa3:$a: NanoCore 0x4b01c:$a: NanoCore 0x5e6c7:$a: NanoCore 0x5e6dc:$a: NanoCore 0x5e711:$a: NanoCore 0x77193:$a: NanoCore 0x771a8:$a: NanoCore 0x771dd:$a: NanoCore 0x4af6f:$b: ClientPlugin 0x4afac:$b: ClientPlugin 0x4b8aa:$b: ClientPlugin 0x4b8b7:$b: ClientPlugin 0x5e483:$b: ClientPlugin 0x5e49e:$b: ClientPlugin 0x5e4ce:$b: ClientPlugin 0x5e6e5:$b: ClientPlugin 0x5e71a:$b: ClientPlugin 0x76f4f:$b: ClientPlugin 0x76f6a:$b: ClientPlugin
0000000C.00000002.508451814.0000000005240000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x5b0b:$x1: NanoCore.ClientPluginHost 0x5b44:$x2: IClientNetworkHost
0000000C.00000002.508451814.0000000005240000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x5b0b:$x2: NanoCore.ClientPluginHost 0x5c0f:$s4: PipeCreated 0x5b25:$s5: IClientLoggingHost
0000000F.00000002.487979449.0000000003D0E000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x91605:$x1: NanoCore.ClientPluginHost 0x91642:$x2: IClientNetworkHost 0x95175:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000F.00000002.487979449.0000000003D0E000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000F.00000002.487979449.0000000003D0E000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x9136d:$a: NanoCore 0x9137d:$a: NanoCore 0x915b1:$a: NanoCore 0x915c5:$a: NanoCore 0x91605:$a: NanoCore 0x913cc:$b: ClientPlugin 0x915ce:$b: ClientPlugin 0x9160e:$b: ClientPlugin 0x914f3:$c: ProjectData 0x91efa:$d: DESCrypto 0x998c6:$e: KeepAlive 0x978b4:$g: LogClientMessage 0x93aaf:$i: get_Connected 0x92230:$j: #=q 0x92260:$j: #=q 0x9227c:$j: #=q 0x922ac:$j: #=q 0x922c8:$j: #=q 0x922e4:$j: #=q 0x92314:$j: #=q 0x92330:$j: #=q
0000000C.00000002.509338103.0000000006C1C000.00000004.00000001.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000C.00000002.493405932.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000002.493405932.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.493405932.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000011.00000002.498841834.0000000002951000.00000004.00000001.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000C.00000002.508629806.0000000005C10000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x13a8:$x1: NanoCore.ClientPluginHost
0000000C.00000002.508629806.0000000005C10000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x13a8:$x2: NanoCore.ClientPluginHost 0x1486:$s4: PipeCreated 0x13c2:$s5: IClientLoggingHost
0000000C.00000002.504360558.00000000041CE000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.504360558.00000000041CE000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1b41:$a: NanoCore 0x1b9a:$a: NanoCore 0x1bd7:$a: NanoCore 0x1c50:$a: NanoCore 0x152fb:$a: NanoCore 0x15310:$a: NanoCore 0x15345:$a: NanoCore 0x22f5a:$a: NanoCore 0x22f7f:$a: NanoCore 0x22fd8:$a: NanoCore 0x33175:$a: NanoCore 0x3319b:$a: NanoCore 0x331f7:$a: NanoCore 0x4004c:$a: NanoCore 0x400a5:$a: NanoCore 0x400d8:$a: NanoCore 0x40304:$a: NanoCore 0x40380:$a: NanoCore 0x40999:$a: NanoCore 0x40ae2:$a: NanoCore 0x40fb6:$a: NanoCore
00000001.00000002.341051840.0000000000E12000.00000002.00020000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000F.00000002.488625589.0000000003DEF000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x37835:$x1: NanoCore.ClientPluginHost 0x5f855:$x1: NanoCore.ClientPluginHost 0x37872:$x2: IClientNetworkHost 0x5f892:$x2: IClientNetworkHost 0x3b3a5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x633c5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000F.00000002.488625589.0000000003DEF000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000F.00000002.488625589.0000000003DEF000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3759d:$a: NanoCore 0x375ad:$a: NanoCore 0x377e1:$a: NanoCore 0x377f5:$a: NanoCore 0x37835:$a: NanoCore 0x5f5bd:$a: NanoCore 0x5f5cd:$a: NanoCore 0x5f801:$a: NanoCore 0x5f815:$a: NanoCore 0x5f855:$a: NanoCore 0x375fc:$b: ClientPlugin 0x377fe:$b: ClientPlugin 0x3783e:$b: ClientPlugin 0x5f61c:$b: ClientPlugin 0x5f81e:$b: ClientPlugin 0x5f85e:$b: ClientPlugin 0x37723:$c: ProjectData 0x5f743:$c: ProjectData 0x3812a:$d: DESCrypto 0x6014a:$d: DESCrypto 0x3faf6:$e: KeepAlive
0000000C.00000002.509088108.00000000065B0000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x5fee:$x1: NanoCore.ClientPluginHost 0x602b:$x2: IClientNetworkHost
0000000C.00000002.509088108.00000000065B0000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x5fee:$x2: NanoCore.ClientPluginHost 0x9441:$s4: PipeCreated 0x6018:$s5: IClientLoggingHost
00000011.00000002.503763443.0000000003AAE000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x91605:$x1: NanoCore.ClientPluginHost 0x91642:$x2: IClientNetworkHost 0x95175:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000011.00000002.503763443.0000000003AAE000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000011.00000002.503763443.0000000003AAE000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x9136d:$a: NanoCore 0x9137d:$a: NanoCore 0x915b1:$a: NanoCore 0x915c5:$a: NanoCore 0x91605:$a: NanoCore 0x913cc:$b: ClientPlugin 0x915ce:$b: ClientPlugin 0x9160e:$b: ClientPlugin 0x914f3:$c: ProjectData 0x91efa:$d: DESCrypto 0x998c6:$e: KeepAlive 0x978b4:$g: LogClientMessage 0x93aaf:$i: get_Connected 0x92230:$j: #=q 0x92260:$j: #=q 0x9227c:$j: #=q 0x922ac:$j: #=q 0x922c8:$j: #=q 0x922e4:$j: #=q 0x92314:$j: #=q 0x92330:$j: #=q
00000001.00000002.342922605.000000000437C000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10c15:$x1: NanoCore.ClientPluginHost 0x10c52:$x2: IClientNetworkHost 0x14785:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000002.342922605.000000000437C000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000002.342922605.000000000437C000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1097d:$a: NanoCore 0x1098d:$a: NanoCore 0x10bc1:$a: NanoCore 0x10bd5:$a: NanoCore 0x10c15:$a: NanoCore 0x109dc:$b: ClientPlugin 0x10bde:$b: ClientPlugin 0x10c1e:$b: ClientPlugin 0x10b03:$c: ProjectData 0x1150a:$d: DESCrypto 0x18ed6:$e: KeepAlive 0x16ec4:$g: LogClientMessage 0x130bf:$i: get_Connected 0x11840:$j: #=q 0x11870:$j: #=q 0x1188c:$j: #=q 0x118bc:$j: #=q 0x118d8:$j: #=q 0x118f4:$j: #=q 0x11924:$j: #=q 0x11940:$j: #=q
0000000C.00000002.504504197.0000000004244000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x55bcf:$a: NanoCore 0x55cb9:$a: NanoCore 0x56b30:$a: NanoCore 0x5fcda:$a: NanoCore 0x5fd3b:$a: NanoCore 0x5fd7e:$a: NanoCore 0x5fdbe:$a: NanoCore 0x5fffa:$a: NanoCore 0x6009a:$a: NanoCore 0x60872:$a: NanoCore 0x60e65:$a: NanoCore 0x60fb6:$a: NanoCore 0x61e10:$a: NanoCore 0x62077:$a: NanoCore 0x6208c:$a: NanoCore 0x620ab:$a: NanoCore 0x6afae:$a: NanoCore 0x6afd7:$a: NanoCore 0x76d50:$a: NanoCore 0x76d79:$a: NanoCore 0x9bc3c:$a: NanoCore
Process Memory Space: RegAsm.exe PID: 5612	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6d25:$x1: NanoCore.ClientPluginHost 0x21d84:$x1: NanoCore.ClientPluginHost 0x5a51a:$x1: NanoCore.ClientPluginHost 0x92e02:$x1: NanoCore.ClientPluginHost 0xbc93e:$x1: NanoCore.ClientPluginHost 0xc7258:$x1: NanoCore.ClientPluginHost 0xd9dd7:$x1: NanoCore.ClientPluginHost 0xdce39:$x1: NanoCore.ClientPluginHost 0xe21ed:$x1: NanoCore.ClientPluginHost 0xe5643:$x1: NanoCore.ClientPluginHost 0xe822e:$x1: NanoCore.ClientPluginHost 0xef3d3:$x1: NanoCore.ClientPluginHost 0xf422e:$x1: NanoCore.ClientPluginHost 0x100a08:$x1: NanoCore.ClientPluginHost 0x107b2e:$x1: NanoCore.ClientPluginHost 0x17ab9b:$x1: NanoCore.ClientPluginHost 0x18075a:$x1: NanoCore.ClientPluginHost 0x18e427:$x1: NanoCore.ClientPluginHost 0x198d41:$x1: NanoCore.ClientPluginHost 0x1ab8bc:$x1: NanoCore.ClientPluginHost 0x1ae2a6:$x1: NanoCore.ClientPluginHost
Process Memory Space: RegAsm.exe PID: 5612	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 5612	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: RegAsm.exe PID: 5612	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6ae1:$a: NanoCore 0x6d25:$a: NanoCore 0x7076:$a: NanoCore 0xcde0:$a: NanoCore 0xcfb6:$a: NanoCore 0xcfdb:$a: NanoCore 0x21d43:$a: NanoCore 0x21d84:$a: NanoCore 0x251d9:$a: NanoCore 0x25200:$a: NanoCore 0x5a51a:$a: NanoCore 0x5a6b8:$a: NanoCore 0x5c072:$a: NanoCore 0x5dc8f:$a: NanoCore 0x5dd6a:$a: NanoCore 0x5eadc:$a: NanoCore 0x859d3:$a: NanoCore 0x85a3a:$a: NanoCore 0x85add:$a: NanoCore 0x92cf4:$a: NanoCore 0x92d95:$a: NanoCore
Process Memory Space: 20014464370.PDF.exe PID: 5480	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2001e:$x1: NanoCore.ClientPluginHost 0x23ad8b:$x1: NanoCore.ClientPluginHost 0x258819:$x1: NanoCore.ClientPluginHost 0x28934a:$x1: NanoCore.ClientPluginHost 0x2007f:$x2: IClientNetworkHost 0x23adec:$x2: IClientNetworkHost 0x25887a:$x2: IClientNetworkHost 0x2893ab:$x2: IClientNetworkHost 0x25484:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x333f6:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2401f1:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x24e163:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x25dc7f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x26bbf1:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x28e7b0:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x29c722:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: 20014464370.PDF.exe PID: 5480	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: 20014464370.PDF.exe PID: 5480	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: 20014464370.PDF.exe PID: 5480	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1fb23:$a: NanoCore 0x1fb3f:$a: NanoCore 0x1fc9a:$a: NanoCore 0x1fca9:$a: NanoCore 0x1ff82:$a: NanoCore 0x1ffae:$a: NanoCore 0x2001e:$a: NanoCore 0x2fa60:$a: NanoCore 0x2fa72:$a: NanoCore 0x2faae:$a: NanoCore 0x23a890:$a: NanoCore 0x23a8ac:$a: NanoCore 0x23aa07:$a: NanoCore 0x23aa16:$a: NanoCore 0x23acef:$a: NanoCore 0x23ad1b:$a: NanoCore 0x23ad8b:$a: NanoCore 0x24a7cd:$a: NanoCore 0x24a7df:$a: NanoCore 0x24a81b:$a: NanoCore 0x25831e:$a: NanoCore
Process Memory Space: AAAstarupxxzzzgb.exe PID: 3604	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: RegAsm.exe PID: 964	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2f8a5:$x1: NanoCore.ClientPluginHost 0x3d6e0:$x1: NanoCore.ClientPluginHost 0x72d49:$x1: NanoCore.ClientPluginHost 0x78908:$x1: NanoCore.ClientPluginHost 0x89792:$x1: NanoCore.ClientPluginHost 0x2f8cb:$x2: IClientNetworkHost 0x3d741:$x2: IClientNetworkHost 0x72d6f:$x2: IClientNetworkHost 0x7894d:$x2: IClientNetworkHost 0x897d7:$x2: IClientNetworkHost 0x42b46:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x50ab8:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: RegAsm.exe PID: 964	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 964	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x7ca9:$a: NanoCore 0x7d10:$a: NanoCore 0x7db4:$a: NanoCore 0x2f797:$a: NanoCore 0x2f838:$a: NanoCore 0x2f8a5:$a: NanoCore 0x2f966:$a: NanoCore 0x30837:$a: NanoCore 0x3088a:$a: NanoCore 0x308c3:$a: NanoCore 0x30936:$a: NanoCore 0x31d2c:$a: NanoCore 0x31e02:$a: NanoCore 0x31e1e:$a: NanoCore 0x31e3a:$a: NanoCore 0x31e56:$a: NanoCore 0x3d1e5:$a: NanoCore 0x3d201:$a: NanoCore 0x3d35c:$a: NanoCore 0x3d36b:$a: NanoCore 0x3d644:$a: NanoCore
Process Memory Space: lkjhgfs.exe PID: 5188	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8ebc6:$x1: NanoCore.ClientPluginHost 0x19816a:$x1: NanoCore.ClientPluginHost 0x208441:$x1: NanoCore.ClientPluginHost 0x225ebd:$x1: NanoCore.ClientPluginHost 0x26f9e7:$x1: NanoCore.ClientPluginHost 0x8ec27:$x2: IClientNetworkHost 0x1981cb:$x2: IClientNetworkHost 0x2084a2:$x2: IClientNetworkHost 0x225f1e:$x2: IClientNetworkHost 0x26fa48:$x2: IClientNetworkHost 0x9402c:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x97eeb:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x19d5d0:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1ab542:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x20d8a7:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x21b819:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x22b323:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x239295:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x274e4d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x282dbf:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: lkjhgfs.exe PID: 5188	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: lkjhgfs.exe PID: 5188	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: lkjhgfs.exe PID: 5188	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x8e6cb:$a: NanoCore 0x8e6e7:$a: NanoCore 0x8e842:$a: NanoCore 0x8e851:$a: NanoCore 0x8eb2a:$a: NanoCore 0x8eb56:$a: NanoCore 0x8ebc6:$a: NanoCore 0x94555:$a: NanoCore 0x94567:$a: NanoCore 0x945a3:$a: NanoCore 0x197c6f:$a: NanoCore 0x197c8b:$a: NanoCore 0x197de6:$a: NanoCore 0x197df5:$a: NanoCore 0x1980ce:$a: NanoCore 0x1980fa:$a: NanoCore 0x19816a:$a: NanoCore 0x1a7bac:$a: NanoCore 0x1a7bbe:$a: NanoCore 0x1a7bfa:$a: NanoCore 0x207f46:$a: NanoCore
Process Memory Space: lkjhgfs.exe PID: 1848	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x24c5c:$x1: NanoCore.ClientPluginHost 0x102dba:$x1: NanoCore.ClientPluginHost 0x2341cd:$x1: NanoCore.ClientPluginHost 0x28a28a:$x1: NanoCore.ClientPluginHost 0x2a7d06:$x1: NanoCore.ClientPluginHost 0x24cbd:$x2: IClientNetworkHost 0x102e1b:$x2: IClientNetworkHost 0x23422e:$x2: IClientNetworkHost 0x28a2eb:$x2: IClientNetworkHost 0x2a7d67:$x2: IClientNetworkHost 0x2a0c2:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2df81:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x108220:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x116192:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x239633:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2475a5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x28f6f0:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x29d662:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2ad16c:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2bb0de:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: lkjhgfs.exe PID: 1848	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: lkjhgfs.exe PID: 1848	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: lkjhgfs.exe PID: 1848	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x24761:$a: NanoCore 0x2477d:$a: NanoCore 0x248d8:$a: NanoCore 0x248e7:$a: NanoCore 0x24bc0:$a: NanoCore 0x24bec:$a: NanoCore 0x24c5c:$a: NanoCore 0x2a5eb:$a: NanoCore 0x2a5fd:$a: NanoCore 0x2a639:$a: NanoCore 0x1028bf:$a: NanoCore 0x1028db:$a: NanoCore 0x102a36:$a: NanoCore 0x102a45:$a: NanoCore 0x102d1e:$a: NanoCore 0x102d4a:$a: NanoCore 0x102dba:$a: NanoCore 0x1127fc:$a: NanoCore 0x11280e:$a: NanoCore 0x11284a:$a: NanoCore 0x233cd2:$a: NanoCore
Click to see the 121 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.RegAsm.exe.6560000.35.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x350b:$x1: NanoCore.ClientPluginHost 0x3525:$x2: IClientNetworkHost
12.2.RegAsm.exe.6560000.35.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x350b:$x2: NanoCore.ClientPluginHost 0x52b6:$s4: PipeCreated 0x34f8:$s5: IClientLoggingHost
12.2.RegAsm.exe.4f80000.22.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
12.2.RegAsm.exe.4f80000.22.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
12.2.RegAsm.exe.4f80000.22.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.42a943e.15.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x3d99:$x1: NanoCore.ClientPluginHost 0xcd3b:$x1: NanoCore.ClientPluginHost 0x3db3:$x2: IClientNetworkHost 0xcd55:$x2: IClientNetworkHost
12.2.RegAsm.exe.42a943e.15.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x3d99:$x2: NanoCore.ClientPluginHost 0xcd3b:$x2: NanoCore.ClientPluginHost 0x4dce:$s4: PipeCreated 0x3d86:$s5: IClientLoggingHost 0xcd28:$s5: IClientLoggingHost
12.2.RegAsm.exe.65b0000.39.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x5fee:$x1: NanoCore.ClientPluginHost 0x602b:$x2: IClientNetworkHost
12.2.RegAsm.exe.65b0000.39.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x5fee:$x2: NanoCore.ClientPluginHost 0x9441:$s4: PipeCreated 0x6018:$s5: IClientLoggingHost
12.2.RegAsm.exe.41d3b98.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
12.2.RegAsm.exe.41d3b98.12.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
12.2.RegAsm.exe.41d3b98.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.20014464370.PDF.exe.432ca68.7.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.20014464370.PDF.exe.432ca68.7.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
1.2.20014464370.PDF.exe.432ca68.7.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.20014464370.PDF.exe.432ca68.7.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
1.2.20014464370.PDF.exe.437ca88.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.20014464370.PDF.exe.437ca88.8.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
1.2.20014464370.PDF.exe.437ca88.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.20014464370.PDF.exe.437ca88.8.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegAsm.exe.6570000.38.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1f1db:$x1: NanoCore.ClientPluginHost 0x1f1f5:$x2: IClientNetworkHost
12.2.RegAsm.exe.6570000.38.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1f1db:$x2: NanoCore.ClientPluginHost 0x22518:$s4: PipeCreated 0x1f1c8:$s5: IClientLoggingHost
15.2.lkjhgfs.exe.2ca980c.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
15.2.lkjhgfs.exe.2ca980c.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0xe3b7:$s5: IClientLoggingHost
15.2.lkjhgfs.exe.2ca980c.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q 0xf0fc:$j: #=q 0xf118:$j: #=q
12.2.RegAsm.exe.65b0000.39.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x41ee:$x1: NanoCore.ClientPluginHost 0x422b:$x2: IClientNetworkHost
12.2.RegAsm.exe.65b0000.39.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x41ee:$x2: NanoCore.ClientPluginHost 0x7641:$s4: PipeCreated 0x4218:$s5: IClientLoggingHost
12.2.RegAsm.exe.4334738.19.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
12.2.RegAsm.exe.4334738.19.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
12.2.RegAsm.exe.4334738.19.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
17.2.lkjhgfs.exe.3bb66a8.10.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
17.2.lkjhgfs.exe.3bb66a8.10.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
17.2.lkjhgfs.exe.3bb66a8.10.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
17.2.lkjhgfs.exe.3bb66a8.10.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
12.2.RegAsm.exe.27b4d94.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2dbb:$x1: NanoCore.ClientPluginHost 0x2de5:$x2: IClientNetworkHost
12.2.RegAsm.exe.27b4d94.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2dbb:$x2: NanoCore.ClientPluginHost 0x4c6b:$s4: PipeCreated
12.2.RegAsm.exe.6530000.33.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1deb:$x1: NanoCore.ClientPluginHost 0x1e24:$x2: IClientNetworkHost
12.2.RegAsm.exe.6530000.33.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1deb:$x2: NanoCore.ClientPluginHost 0x1f36:$s4: PipeCreated 0x1e05:$s5: IClientLoggingHost
23.2.RegAsm.exe.3deff64.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
23.2.RegAsm.exe.3deff64.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
23.2.RegAsm.exe.3deff64.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
22.0.AAAstarupxxzzzgb.exe.50000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
12.2.RegAsm.exe.40b9625.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6da5:$x1: NanoCore.ClientPluginHost 0x6dd2:$x2: IClientNetworkHost
12.2.RegAsm.exe.40b9625.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x6da5:$x2: NanoCore.ClientPluginHost 0x7d74:$s2: FileCommand 0xc776:$s4: PipeCreated 0x6dbf:$s5: IClientLoggingHost
23.2.RegAsm.exe.3deb12e.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d0af:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d0dc:$x2: IClientNetworkHost
23.2.RegAsm.exe.3deb12e.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d0af:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e18a:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d0c9:$s5: IClientLoggingHost
23.2.RegAsm.exe.3deb12e.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
23.2.RegAsm.exe.3deb12e.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d065:$a: NanoCore 0x2d07a:$a: NanoCore 0x2d0af:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2ce21:$b: ClientPlugin 0x2ce3c:$b: ClientPlugin
12.2.RegAsm.exe.5200000.26.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6da5:$x1: NanoCore.ClientPluginHost 0x6dd2:$x2: IClientNetworkHost
12.2.RegAsm.exe.5200000.26.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x6da5:$x2: NanoCore.ClientPluginHost 0x7d74:$s2: FileCommand 0xc776:$s4: PipeCreated 0x6dbf:$s5: IClientLoggingHost
12.2.RegAsm.exe.5220000.27.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x16e3:$x1: NanoCore.ClientPluginHost 0x171c:$x2: IClientNetworkHost
12.2.RegAsm.exe.5220000.27.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x16e3:$x2: NanoCore.ClientPluginHost 0x1800:$s4: PipeCreated 0x16fd:$s5: IClientLoggingHost
12.2.RegAsm.exe.42b786e.16.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x170b:$x1: NanoCore.ClientPluginHost 0x1725:$x2: IClientNetworkHost
12.2.RegAsm.exe.42b786e.16.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x170b:$x2: NanoCore.ClientPluginHost 0x34b6:$s4: PipeCreated 0x16f8:$s5: IClientLoggingHost
12.2.RegAsm.exe.27c0fdc.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6da5:$x1: NanoCore.ClientPluginHost 0x6dd2:$x2: IClientNetworkHost
12.2.RegAsm.exe.27c0fdc.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x6da5:$x2: NanoCore.ClientPluginHost 0x7d74:$s2: FileCommand 0xc776:$s4: PipeCreated 0x6dbf:$s5: IClientLoggingHost
12.2.RegAsm.exe.5250000.29.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x605:$x1: NanoCore.ClientPluginHost 0x63e:$x2: IClientNetworkHost
12.2.RegAsm.exe.5250000.29.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x605:$x2: NanoCore.ClientPluginHost 0x720:$s4: PipeCreated 0x61f:$s5: IClientLoggingHost
17.2.lkjhgfs.exe.3c2e6e8.12.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
17.2.lkjhgfs.exe.3c2e6e8.12.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
17.2.lkjhgfs.exe.3c2e6e8.12.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
17.2.lkjhgfs.exe.3c2e6e8.12.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegAsm.exe.6cd305a.42.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
23.0.RegAsm.exe.400000.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
23.0.RegAsm.exe.400000.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
23.0.RegAsm.exe.400000.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
23.0.RegAsm.exe.400000.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegAsm.exe.5240000.28.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x5b0b:$x1: NanoCore.ClientPluginHost 0x5b44:$x2: IClientNetworkHost
12.2.RegAsm.exe.5240000.28.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x5b0b:$x2: NanoCore.ClientPluginHost 0x5c0f:$s4: PipeCreated 0x5b25:$s5: IClientLoggingHost
12.2.RegAsm.exe.4f70000.21.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
12.2.RegAsm.exe.4f70000.21.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
1.2.20014464370.PDF.exe.437ca88.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.20014464370.PDF.exe.437ca88.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
1.2.20014464370.PDF.exe.437ca88.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.20014464370.PDF.exe.437ca88.8.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
15.2.lkjhgfs.exe.3e8e6e8.10.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
15.2.lkjhgfs.exe.3e8e6e8.10.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
15.2.lkjhgfs.exe.3e8e6e8.10.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.lkjhgfs.exe.3e8e6e8.10.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
22.2.AAAstarupxxzzzgb.exe.50000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
23.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
23.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
23.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
23.2.RegAsm.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
17.2.lkjhgfs.exe.3c2e6e8.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
17.2.lkjhgfs.exe.3c2e6e8.12.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
17.2.lkjhgfs.exe.3c2e6e8.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
17.2.lkjhgfs.exe.3c2e6e8.12.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
12.2.RegAsm.exe.42a943e.15.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x5b99:$x1: NanoCore.ClientPluginHost 0x1193b:$x1: NanoCore.ClientPluginHost 0x3683f:$x1: NanoCore.ClientPluginHost 0x45c7f:$x1: NanoCore.ClientPluginHost 0x5bb3:$x2: IClientNetworkHost 0x11955:$x2: IClientNetworkHost 0x36859:$x2: IClientNetworkHost 0x45cbc:$x2: IClientNetworkHost
12.2.RegAsm.exe.42a943e.15.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x5b99:$x2: NanoCore.ClientPluginHost 0x1193b:$x2: NanoCore.ClientPluginHost 0x3683f:$x2: NanoCore.ClientPluginHost 0x45c7f:$x2: NanoCore.ClientPluginHost 0x6bce:$s4: PipeCreated 0x136e6:$s4: PipeCreated 0x39b7c:$s4: PipeCreated 0x490d2:$s4: PipeCreated 0x5b86:$s5: IClientLoggingHost 0x11928:$s5: IClientLoggingHost 0x3682c:$s5: IClientLoggingHost 0x45ca9:$s5: IClientLoggingHost
1.2.20014464370.PDF.exe.4304a48.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.20014464370.PDF.exe.4304a48.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
1.2.20014464370.PDF.exe.4304a48.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.20014464370.PDF.exe.4304a48.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
12.2.RegAsm.exe.41d81c1.13.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x18dbe:$x1: NanoCore.ClientPluginHost 0x28fda:$x1: NanoCore.ClientPluginHost 0x36143:$x1: NanoCore.ClientPluginHost 0x3c691:$x1: NanoCore.ClientPluginHost 0x42662:$x1: NanoCore.ClientPluginHost 0x4c0ce:$x1: NanoCore.ClientPluginHost 0x564f9:$x1: NanoCore.ClientPluginHost 0x614d6:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x18de8:$x2: IClientNetworkHost 0x29007:$x2: IClientNetworkHost 0x3617c:$x2: IClientNetworkHost 0x3c6ca:$x2: IClientNetworkHost 0x4c22b:$x2: IClientNetworkHost 0x56532:$x2: IClientNetworkHost 0x614f0:$x2: IClientNetworkHost
12.2.RegAsm.exe.41d81c1.13.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x18dbe:$x2: NanoCore.ClientPluginHost 0x28fda:$x2: NanoCore.ClientPluginHost 0x36143:$x2: NanoCore.ClientPluginHost 0x3c691:$x2: NanoCore.ClientPluginHost 0x42662:$x2: NanoCore.ClientPluginHost 0x4c0ce:$x2: NanoCore.ClientPluginHost 0x564f9:$x2: NanoCore.ClientPluginHost 0x614d6:$x2: NanoCore.ClientPluginHost 0x29fa9:$s2: FileCommand 0x4d024:$s3: PipeExists 0xc25f:$s4: PipeCreated 0x1ac6e:$s4: PipeCreated 0x2e9ab:$s4: PipeCreated 0x36260:$s4: PipeCreated 0x3c7ac:$s4: PipeCreated 0x42740:$s4: PipeCreated 0x4c2c4:$s4: PipeCreated 0x56644:$s4: PipeCreated 0x6250b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
12.2.RegAsm.exe.41d81c1.13.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.41d81c1.13.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xb13a:$a: NanoCore 0xb14f:$a: NanoCore 0xb184:$a: NanoCore 0x18d99:$a: NanoCore 0x18dbe:$a: NanoCore 0x18e17:$a: NanoCore 0x28fb4:$a: NanoCore 0x28fda:$a: NanoCore 0x29036:$a: NanoCore 0x35e8b:$a: NanoCore 0x35ee4:$a: NanoCore 0x35f17:$a: NanoCore 0x36143:$a: NanoCore 0x361bf:$a: NanoCore 0x367d8:$a: NanoCore 0x36921:$a: NanoCore 0x36df5:$a: NanoCore 0x370dc:$a: NanoCore 0x370f3:$a: NanoCore 0x3c691:$a: NanoCore 0x3c70b:$a: NanoCore
12.2.RegAsm.exe.40ad3f1.9.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2dbb:$x1: NanoCore.ClientPluginHost 0x2de5:$x2: IClientNetworkHost
12.2.RegAsm.exe.40ad3f1.9.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2dbb:$x2: NanoCore.ClientPluginHost 0x4c6b:$s4: PipeCreated
12.2.RegAsm.exe.6540000.34.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x5b99:$x1: NanoCore.ClientPluginHost 0x5bb3:$x2: IClientNetworkHost
12.2.RegAsm.exe.6540000.34.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x5b99:$x2: NanoCore.ClientPluginHost 0x6bce:$s4: PipeCreated 0x5b86:$s5: IClientLoggingHost
23.0.RegAsm.exe.400000.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
23.0.RegAsm.exe.400000.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
23.0.RegAsm.exe.400000.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
23.0.RegAsm.exe.400000.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegAsm.exe.377ff64.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28279:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x282a6:$x2: IClientNetworkHost
12.2.RegAsm.exe.377ff64.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28279:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x29354:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x28293:$s5: IClientLoggingHost
12.2.RegAsm.exe.377ff64.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
23.2.RegAsm.exe.3deff64.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28279:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x282a6:$x2: IClientNetworkHost
23.2.RegAsm.exe.3deff64.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28279:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x29354:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x28293:$s5: IClientLoggingHost
23.2.RegAsm.exe.3deff64.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.27b4d94.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4bbb:$x1: NanoCore.ClientPluginHost 0x14ded:$x1: NanoCore.ClientPluginHost 0x21f67:$x1: NanoCore.ClientPluginHost 0x2bdc7:$x1: NanoCore.ClientPluginHost 0x33cfd:$x1: NanoCore.ClientPluginHost 0x39ce0:$x1: NanoCore.ClientPluginHost 0x4375b:$x1: NanoCore.ClientPluginHost 0x4db97:$x1: NanoCore.ClientPluginHost 0x58b89:$x1: NanoCore.ClientPluginHost 0x6493f:$x1: NanoCore.ClientPluginHost 0x70696:$x1: NanoCore.ClientPluginHost 0x4be5:$x2: IClientNetworkHost 0x14e1a:$x2: IClientNetworkHost 0x21fa0:$x2: IClientNetworkHost 0x2be00:$x2: IClientNetworkHost 0x33d36:$x2: IClientNetworkHost 0x438b8:$x2: IClientNetworkHost 0x4dbd0:$x2: IClientNetworkHost 0x58ba3:$x2: IClientNetworkHost 0x64959:$x2: IClientNetworkHost 0x706d3:$x2: IClientNetworkHost
12.2.RegAsm.exe.27b4d94.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4b96:$a: NanoCore 0x4bbb:$a: NanoCore 0x4c14:$a: NanoCore 0x14dc7:$a: NanoCore 0x14ded:$a: NanoCore 0x14e49:$a: NanoCore 0x21caf:$a: NanoCore 0x21d08:$a: NanoCore 0x21d3b:$a: NanoCore 0x21f67:$a: NanoCore 0x21fe3:$a: NanoCore 0x225fc:$a: NanoCore 0x22745:$a: NanoCore 0x22c19:$a: NanoCore 0x22f00:$a: NanoCore 0x22f17:$a: NanoCore 0x2bdc7:$a: NanoCore 0x2be43:$a: NanoCore 0x2e726:$a: NanoCore 0x33cfd:$a: NanoCore 0x33d77:$a: NanoCore
12.2.RegAsm.exe.4f84629.23.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
12.2.RegAsm.exe.4f84629.23.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
12.2.RegAsm.exe.4f84629.23.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.lkjhgfs.exe.7b0000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
12.2.RegAsm.exe.4f80000.22.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
12.2.RegAsm.exe.4f80000.22.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
12.2.RegAsm.exe.4f80000.22.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.5200000.26.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8ba5:$x1: NanoCore.ClientPluginHost 0x8bd2:$x2: IClientNetworkHost
12.2.RegAsm.exe.5200000.26.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x8ba5:$x2: NanoCore.ClientPluginHost 0x9b74:$s2: FileCommand 0xe576:$s4: PipeCreated 0x8bbf:$s5: IClientLoggingHost
17.2.lkjhgfs.exe.3aae278.9.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x9138d:$x1: NanoCore.ClientPluginHost 0x913ca:$x2: IClientNetworkHost 0x94efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
17.2.lkjhgfs.exe.3aae278.9.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
17.2.lkjhgfs.exe.3aae278.9.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x910f5:$a: NanoCore 0x91105:$a: NanoCore 0x91339:$a: NanoCore 0x9134d:$a: NanoCore 0x9138d:$a: NanoCore 0x91154:$b: ClientPlugin 0x91356:$b: ClientPlugin 0x91396:$b: ClientPlugin 0x9127b:$c: ProjectData 0x91c82:$d: DESCrypto 0x9964e:$e: KeepAlive 0x9763c:$g: LogClientMessage 0x93837:$i: get_Connected 0x91fb8:$j: #=q 0x91fe8:$j: #=q 0x92004:$j: #=q 0x92034:$j: #=q 0x92050:$j: #=q 0x9206c:$j: #=q 0x9209c:$j: #=q 0x920b8:$j: #=q
15.2.lkjhgfs.exe.3e8e6e8.10.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
15.2.lkjhgfs.exe.3e8e6e8.10.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
15.2.lkjhgfs.exe.3e8e6e8.10.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.lkjhgfs.exe.3e8e6e8.10.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
15.2.lkjhgfs.exe.3e3e6c8.9.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
15.2.lkjhgfs.exe.3e3e6c8.9.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
15.2.lkjhgfs.exe.3e3e6c8.9.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.lkjhgfs.exe.3e3e6c8.9.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.0.RegAsm.exe.400000.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.RegAsm.exe.400000.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
17.2.lkjhgfs.exe.3bb66a8.10.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x381ad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x381ea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x3bd1d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
17.2.lkjhgfs.exe.3bb66a8.10.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x37f25:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x381ad:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x397e6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x397da:$s2: FileCommand 0x1266b:$s3: PipeExists 0x3a68b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x40442:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x381d7:$s5: IClientLoggingHost
12.0.RegAsm.exe.400000.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
17.2.lkjhgfs.exe.3bb66a8.10.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.RegAsm.exe.400000.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
17.2.lkjhgfs.exe.3bb66a8.10.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x37f15:$a: NanoCore 0x37f25:$a: NanoCore 0x38159:$a: NanoCore 0x3816d:$a: NanoCore 0x381ad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x37f74:$b: ClientPlugin 0x38176:$b: ClientPlugin 0x381b6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x3809b:$c: ProjectData 0x10a82:$d: DESCrypto 0x38aa2:$d: DESCrypto 0x1844e:$e: KeepAlive
23.2.RegAsm.exe.2e09670.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
23.2.RegAsm.exe.2e09670.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
12.2.RegAsm.exe.6520000.32.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x3deb:$x1: NanoCore.ClientPluginHost 0x3f48:$x2: IClientNetworkHost
12.2.RegAsm.exe.6520000.32.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x3deb:$x2: NanoCore.ClientPluginHost 0x4d41:$s3: PipeExists 0x3fe1:$s4: PipeCreated 0x3e05:$s5: IClientLoggingHost
12.2.RegAsm.exe.6560000.35.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x170b:$x1: NanoCore.ClientPluginHost 0x1725:$x2: IClientNetworkHost
12.2.RegAsm.exe.6560000.35.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x170b:$x2: NanoCore.ClientPluginHost 0x34b6:$s4: PipeCreated 0x16f8:$s5: IClientLoggingHost
12.2.RegAsm.exe.41ced62.11.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2221d:$x1: NanoCore.ClientPluginHost 0x32439:$x1: NanoCore.ClientPluginHost 0x3f5a2:$x1: NanoCore.ClientPluginHost 0x45af0:$x1: NanoCore.ClientPluginHost 0x4bac1:$x1: NanoCore.ClientPluginHost 0x5552d:$x1: NanoCore.ClientPluginHost 0x5f958:$x1: NanoCore.ClientPluginHost 0x6a935:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x22247:$x2: IClientNetworkHost 0x32466:$x2: IClientNetworkHost 0x3f5db:$x2: IClientNetworkHost 0x45b29:$x2: IClientNetworkHost 0x5568a:$x2: IClientNetworkHost 0x5f991:$x2: IClientNetworkHost 0x6a94f:$x2: IClientNetworkHost
12.2.RegAsm.exe.41ced62.11.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2221d:$x2: NanoCore.ClientPluginHost 0x32439:$x2: NanoCore.ClientPluginHost 0x3f5a2:$x2: NanoCore.ClientPluginHost 0x45af0:$x2: NanoCore.ClientPluginHost 0x4bac1:$x2: NanoCore.ClientPluginHost 0x5552d:$x2: NanoCore.ClientPluginHost 0x5f958:$x2: NanoCore.ClientPluginHost 0x6a935:$x2: NanoCore.ClientPluginHost 0x33408:$s2: FileCommand 0x1261:$s3: PipeExists 0x56483:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x240cd:$s4: PipeCreated 0x37e0a:$s4: PipeCreated 0x3f6bf:$s4: PipeCreated 0x45c0b:$s4: PipeCreated 0x4bb9f:$s4: PipeCreated 0x55723:$s4: PipeCreated
12.2.RegAsm.exe.41ced62.11.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.41ced62.11.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x221f8:$a: NanoCore 0x2221d:$a: NanoCore 0x22276:$a: NanoCore 0x32413:$a: NanoCore 0x32439:$a: NanoCore 0x32495:$a: NanoCore 0x3f2ea:$a: NanoCore 0x3f343:$a: NanoCore 0x3f376:$a: NanoCore 0x3f5a2:$a: NanoCore 0x3f61e:$a: NanoCore 0x3fc37:$a: NanoCore 0x3fd80:$a: NanoCore 0x40254:$a: NanoCore
12.2.RegAsm.exe.378458d.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x23c50:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x23c7d:$x2: IClientNetworkHost
12.2.RegAsm.exe.378458d.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x23c50:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x24d2b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x23c6a:$s5: IClientLoggingHost
12.2.RegAsm.exe.378458d.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.42b786e.16.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x350b:$x1: NanoCore.ClientPluginHost 0x2840f:$x1: NanoCore.ClientPluginHost 0x3784f:$x1: NanoCore.ClientPluginHost 0x3525:$x2: IClientNetworkHost 0x28429:$x2: IClientNetworkHost 0x3788c:$x2: IClientNetworkHost
12.2.RegAsm.exe.42b786e.16.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x350b:$x2: NanoCore.ClientPluginHost 0x2840f:$x2: NanoCore.ClientPluginHost 0x3784f:$x2: NanoCore.ClientPluginHost 0x52b6:$s4: PipeCreated 0x2b74c:$s4: PipeCreated 0x3aca2:$s4: PipeCreated 0x34f8:$s5: IClientLoggingHost 0x283fc:$s5: IClientLoggingHost 0x37879:$s5: IClientLoggingHost
12.2.RegAsm.exe.6cd305a.42.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
15.0.lkjhgfs.exe.7b0000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
12.2.RegAsm.exe.6540000.34.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x3d99:$x1: NanoCore.ClientPluginHost 0x3db3:$x2: IClientNetworkHost
12.2.RegAsm.exe.6540000.34.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x3d99:$x2: NanoCore.ClientPluginHost 0x4dce:$s4: PipeCreated 0x3d86:$s5: IClientLoggingHost
23.2.RegAsm.exe.3df458d.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x23c50:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x23c7d:$x2: IClientNetworkHost
23.2.RegAsm.exe.3df458d.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x23c50:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x24d2b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x23c6a:$s5: IClientLoggingHost
23.2.RegAsm.exe.3df458d.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.4338d61.18.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.4338d61.18.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xb13a:$a: NanoCore 0xb14f:$a: NanoCore 0xb184:$a: NanoCore 0x18d99:$a: NanoCore 0x18dbe:$a: NanoCore 0x18e17:$a: NanoCore 0x28fb4:$a: NanoCore 0x28fda:$a: NanoCore 0x29036:$a: NanoCore 0x35e8b:$a: NanoCore 0x35ee4:$a: NanoCore 0x35f17:$a: NanoCore 0x36143:$a: NanoCore 0x361bf:$a: NanoCore 0x367d8:$a: NanoCore 0x36921:$a: NanoCore 0x36df5:$a: NanoCore 0x370dc:$a: NanoCore 0x370f3:$a: NanoCore 0x3c691:$a: NanoCore 0x3c70b:$a: NanoCore
12.2.RegAsm.exe.51f0000.25.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4bbb:$x1: NanoCore.ClientPluginHost 0x4be5:$x2: IClientNetworkHost
12.2.RegAsm.exe.51f0000.25.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x4bbb:$x2: NanoCore.ClientPluginHost 0x6a6b:$s4: PipeCreated
15.2.lkjhgfs.exe.3e166a8.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
15.2.lkjhgfs.exe.3e166a8.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
15.2.lkjhgfs.exe.3e166a8.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.lkjhgfs.exe.3e166a8.8.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
1.0.20014464370.PDF.exe.e10000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
1.2.20014464370.PDF.exe.432ca68.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.20014464370.PDF.exe.432ca68.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
1.2.20014464370.PDF.exe.432ca68.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.20014464370.PDF.exe.432ca68.7.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegAsm.exe.6570000.38.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1d3db:$x1: NanoCore.ClientPluginHost 0x1d3f5:$x2: IClientNetworkHost
12.2.RegAsm.exe.6570000.38.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1d3db:$x2: NanoCore.ClientPluginHost 0x20718:$s4: PipeCreated 0x1d3c8:$s5: IClientLoggingHost
12.2.RegAsm.exe.5250000.29.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2205:$x1: NanoCore.ClientPluginHost 0x223e:$x2: IClientNetworkHost
12.2.RegAsm.exe.5250000.29.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2205:$x2: NanoCore.ClientPluginHost 0x2320:$s4: PipeCreated 0x221f:$s5: IClientLoggingHost
12.2.RegAsm.exe.6520000.32.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x59eb:$x1: NanoCore.ClientPluginHost 0x5b48:$x2: IClientNetworkHost
12.2.RegAsm.exe.6520000.32.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x59eb:$x2: NanoCore.ClientPluginHost 0x6941:$s3: PipeExists 0x5be1:$s4: PipeCreated 0x5a05:$s5: IClientLoggingHost
12.2.RegAsm.exe.51f0000.25.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2dbb:$x1: NanoCore.ClientPluginHost 0x2de5:$x2: IClientNetworkHost
12.2.RegAsm.exe.51f0000.25.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2dbb:$x2: NanoCore.ClientPluginHost 0x4c6b:$s4: PipeCreated
12.2.RegAsm.exe.42a060f.14.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1deb:$x1: NanoCore.ClientPluginHost 0x1e24:$x2: IClientNetworkHost
12.2.RegAsm.exe.42a060f.14.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1deb:$x2: NanoCore.ClientPluginHost 0x1f36:$s4: PipeCreated 0x1e05:$s5: IClientLoggingHost
12.2.RegAsm.exe.42a060f.14.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x39eb:$x1: NanoCore.ClientPluginHost 0xe9c8:$x1: NanoCore.ClientPluginHost 0x1a76a:$x1: NanoCore.ClientPluginHost 0x3f66e:$x1: NanoCore.ClientPluginHost 0x4eaae:$x1: NanoCore.ClientPluginHost 0x3a24:$x2: IClientNetworkHost 0xe9e2:$x2: IClientNetworkHost 0x1a784:$x2: IClientNetworkHost 0x3f688:$x2: IClientNetworkHost 0x4eaeb:$x2: IClientNetworkHost
12.2.RegAsm.exe.42a060f.14.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x39eb:$x2: NanoCore.ClientPluginHost 0xe9c8:$x2: NanoCore.ClientPluginHost 0x1a76a:$x2: NanoCore.ClientPluginHost 0x3f66e:$x2: NanoCore.ClientPluginHost 0x4eaae:$x2: NanoCore.ClientPluginHost 0x3b36:$s4: PipeCreated 0xf9fd:$s4: PipeCreated 0x1c515:$s4: PipeCreated 0x429ab:$s4: PipeCreated 0x51f01:$s4: PipeCreated 0x3a05:$s5: IClientLoggingHost 0xe9b5:$s5: IClientLoggingHost 0x1a757:$s5: IClientLoggingHost 0x3f65b:$s5: IClientLoggingHost 0x4ead8:$s5: IClientLoggingHost
12.2.RegAsm.exe.42a060f.14.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x36cb:$a: NanoCore 0x372c:$a: NanoCore 0x376f:$a: NanoCore 0x37af:$a: NanoCore 0x39eb:$a: NanoCore 0x3a8b:$a: NanoCore 0x4263:$a: NanoCore 0x4856:$a: NanoCore 0x49a7:$a: NanoCore 0x5801:$a: NanoCore 0x5a68:$a: NanoCore 0x5a7d:$a: NanoCore 0x5a9c:$a: NanoCore 0xe99f:$a: NanoCore 0xe9c8:$a: NanoCore 0x1a741:$a: NanoCore 0x1a76a:$a: NanoCore 0x3f62d:$a: NanoCore 0x3f645:$a: NanoCore 0x3f66e:$a: NanoCore 0x4ea71:$a: NanoCore
12.2.RegAsm.exe.6574c9f.36.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1a53c:$x1: NanoCore.ClientPluginHost 0x1a556:$x2: IClientNetworkHost
12.2.RegAsm.exe.6574c9f.36.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1a53c:$x2: NanoCore.ClientPluginHost 0x1d879:$s4: PipeCreated 0x1a529:$s5: IClientLoggingHost
15.2.lkjhgfs.exe.3e166a8.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x381ad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x381ea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x3bd1d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
15.2.lkjhgfs.exe.3e166a8.8.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x37f25:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x381ad:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x397e6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x397da:$s2: FileCommand 0x1266b:$s3: PipeExists 0x3a68b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x40442:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x381d7:$s5: IClientLoggingHost
15.2.lkjhgfs.exe.3e166a8.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.lkjhgfs.exe.3e166a8.8.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x37f15:$a: NanoCore 0x37f25:$a: NanoCore 0x38159:$a: NanoCore 0x3816d:$a: NanoCore 0x381ad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x37f74:$b: ClientPlugin 0x38176:$b: ClientPlugin 0x381b6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x3809b:$c: ProjectData 0x10a82:$d: DESCrypto 0x38aa2:$d: DESCrypto 0x1844e:$e: KeepAlive
15.2.lkjhgfs.exe.3e3e6c8.9.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
15.2.lkjhgfs.exe.3e3e6c8.9.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
15.2.lkjhgfs.exe.3e3e6c8.9.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.lkjhgfs.exe.3e3e6c8.9.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
12.2.RegAsm.exe.6530000.33.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x39eb:$x1: NanoCore.ClientPluginHost 0x3a24:$x2: IClientNetworkHost
12.2.RegAsm.exe.6530000.33.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x39eb:$x2: NanoCore.ClientPluginHost 0x3b36:$s4: PipeCreated 0x3a05:$s5: IClientLoggingHost
12.2.RegAsm.exe.377b12e.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d0af:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d0dc:$x2: IClientNetworkHost
12.2.RegAsm.exe.377b12e.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d0af:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e18a:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d0c9:$s5: IClientLoggingHost
12.2.RegAsm.exe.377b12e.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.377b12e.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d065:$a: NanoCore 0x2d07a:$a: NanoCore 0x2d0af:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2ce21:$b: ClientPlugin 0x2ce3c:$b: ClientPlugin
1.2.20014464370.PDF.exe.41fc618.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x9138d:$x1: NanoCore.ClientPluginHost 0x913ca:$x2: IClientNetworkHost 0x94efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.20014464370.PDF.exe.41fc618.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.20014464370.PDF.exe.41fc618.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x910f5:$a: NanoCore 0x91105:$a: NanoCore 0x91339:$a: NanoCore 0x9134d:$a: NanoCore 0x9138d:$a: NanoCore 0x91154:$b: ClientPlugin 0x91356:$b: ClientPlugin 0x91396:$b: ClientPlugin 0x9127b:$c: ProjectData 0x91c82:$d: DESCrypto 0x9964e:$e: KeepAlive 0x9763c:$g: LogClientMessage 0x93837:$i: get_Connected 0x91fb8:$j: #=q 0x91fe8:$j: #=q 0x92004:$j: #=q 0x92034:$j: #=q 0x92050:$j: #=q 0x9206c:$j: #=q 0x9209c:$j: #=q 0x920b8:$j: #=q
12.2.RegAsm.exe.27c0fdc.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8ba5:$x1: NanoCore.ClientPluginHost 0x15d1f:$x1: NanoCore.ClientPluginHost 0x1fb7f:$x1: NanoCore.ClientPluginHost 0x27ab5:$x1: NanoCore.ClientPluginHost 0x2da98:$x1: NanoCore.ClientPluginHost 0x37513:$x1: NanoCore.ClientPluginHost 0x4194f:$x1: NanoCore.ClientPluginHost 0x4c941:$x1: NanoCore.ClientPluginHost 0x586f7:$x1: NanoCore.ClientPluginHost 0x6444e:$x1: NanoCore.ClientPluginHost 0x8bd2:$x2: IClientNetworkHost 0x15d58:$x2: IClientNetworkHost 0x1fbb8:$x2: IClientNetworkHost 0x27aee:$x2: IClientNetworkHost 0x37670:$x2: IClientNetworkHost 0x41988:$x2: IClientNetworkHost 0x4c95b:$x2: IClientNetworkHost 0x58711:$x2: IClientNetworkHost 0x6448b:$x2: IClientNetworkHost
12.2.RegAsm.exe.27c0fdc.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x8b7f:$a: NanoCore 0x8ba5:$a: NanoCore 0x8c01:$a: NanoCore 0x15a67:$a: NanoCore 0x15ac0:$a: NanoCore 0x15af3:$a: NanoCore 0x15d1f:$a: NanoCore 0x15d9b:$a: NanoCore 0x163b4:$a: NanoCore 0x164fd:$a: NanoCore 0x169d1:$a: NanoCore 0x16cb8:$a: NanoCore 0x16ccf:$a: NanoCore 0x1fb7f:$a: NanoCore 0x1fbfb:$a: NanoCore 0x224de:$a: NanoCore 0x27ab5:$a: NanoCore 0x27b2f:$a: NanoCore 0x2da98:$a: NanoCore 0x2dae2:$a: NanoCore 0x2e73c:$a: NanoCore
12.2.RegAsm.exe.377ff64.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
12.2.RegAsm.exe.377ff64.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
12.2.RegAsm.exe.377ff64.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.41d3b98.12.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x1d3e7:$x1: NanoCore.ClientPluginHost 0x2d603:$x1: NanoCore.ClientPluginHost 0x3a76c:$x1: NanoCore.ClientPluginHost 0x40cba:$x1: NanoCore.ClientPluginHost 0x46c8b:$x1: NanoCore.ClientPluginHost 0x506f7:$x1: NanoCore.ClientPluginHost 0x5ab22:$x1: NanoCore.ClientPluginHost 0x65aff:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x1d411:$x2: IClientNetworkHost 0x2d630:$x2: IClientNetworkHost 0x3a7a5:$x2: IClientNetworkHost 0x40cf3:$x2: IClientNetworkHost 0x50854:$x2: IClientNetworkHost 0x5ab5b:$x2: IClientNetworkHost 0x65b19:$x2: IClientNetworkHost
12.2.RegAsm.exe.41d3b98.12.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x1d3e7:$x2: NanoCore.ClientPluginHost 0x2d603:$x2: NanoCore.ClientPluginHost 0x3a76c:$x2: NanoCore.ClientPluginHost 0x40cba:$x2: NanoCore.ClientPluginHost 0x46c8b:$x2: NanoCore.ClientPluginHost 0x506f7:$x2: NanoCore.ClientPluginHost 0x5ab22:$x2: NanoCore.ClientPluginHost 0x65aff:$x2: NanoCore.ClientPluginHost 0x2e5d2:$s2: FileCommand 0x5164d:$s3: PipeExists 0x10888:$s4: PipeCreated 0x1f297:$s4: PipeCreated 0x32fd4:$s4: PipeCreated 0x3a889:$s4: PipeCreated 0x40dd5:$s4: PipeCreated 0x46d69:$s4: PipeCreated 0x508ed:$s4: PipeCreated 0x5ac6d:$s4: PipeCreated 0x66b34:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
17.2.lkjhgfs.exe.2c7570c.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.2.RegAsm.exe.41d3b98.12.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.40b9625.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.40b9625.8.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x8b7f:$a: NanoCore 0x8ba5:$a: NanoCore 0x8c01:$a: NanoCore 0x15a58:$a: NanoCore 0x15ab1:$a: NanoCore 0x15ae4:$a: NanoCore 0x15d10:$a: NanoCore 0x15d8c:$a: NanoCore 0x163a5:$a: NanoCore 0x164ee:$a: NanoCore 0x169c2:$a: NanoCore 0x16ca9:$a: NanoCore 0x16cc0:$a: NanoCore 0x1fb64:$a: NanoCore 0x1fbe0:$a: NanoCore 0x224c3:$a: NanoCore 0x27a8c:$a: NanoCore 0x27b06:$a: NanoCore 0x2c6a3:$a: NanoCore 0x2da5f:$a: NanoCore 0x2daa9:$a: NanoCore
1.2.20014464370.PDF.exe.e10000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
12.2.RegAsm.exe.6d5a9f0.41.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
12.0.RegAsm.exe.400000.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.RegAsm.exe.400000.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.RegAsm.exe.400000.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.RegAsm.exe.400000.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegAsm.exe.657e8a4.37.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10937:$x1: NanoCore.ClientPluginHost 0x10951:$x2: IClientNetworkHost
12.2.RegAsm.exe.657e8a4.37.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x10937:$x2: NanoCore.ClientPluginHost 0x13c74:$s4: PipeCreated 0x10924:$s5: IClientLoggingHost
12.2.RegAsm.exe.6d5a9f0.41.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
17.2.lkjhgfs.exe.2c7570c.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x101b7:$s5: IClientLoggingHost
17.2.lkjhgfs.exe.2c7570c.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q 0x10efc:$j: #=q 0x10f18:$j: #=q
12.2.RegAsm.exe.41d3b98.12.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf763:$a: NanoCore 0xf778:$a: NanoCore 0xf7ad:$a: NanoCore 0x1d3c2:$a: NanoCore 0x1d3e7:$a: NanoCore 0x1d440:$a: NanoCore 0x2d5dd:$a: NanoCore 0x2d603:$a: NanoCore 0x2d65f:$a: NanoCore 0x3a4b4:$a: NanoCore 0x3a50d:$a: NanoCore 0x3a540:$a: NanoCore 0x3a76c:$a: NanoCore 0x3a7e8:$a: NanoCore 0x3ae01:$a: NanoCore 0x3af4a:$a: NanoCore 0x3b41e:$a: NanoCore 0x3b705:$a: NanoCore 0x3b71c:$a: NanoCore 0x40cba:$a: NanoCore 0x40d34:$a: NanoCore
12.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegAsm.exe.432f902.17.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.432f902.17.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x221f8:$a: NanoCore 0x2221d:$a: NanoCore 0x22276:$a: NanoCore 0x32413:$a: NanoCore 0x32439:$a: NanoCore 0x32495:$a: NanoCore 0x3f2ea:$a: NanoCore 0x3f343:$a: NanoCore 0x3f376:$a: NanoCore 0x3f5a2:$a: NanoCore 0x3f61e:$a: NanoCore 0x3fc37:$a: NanoCore 0x3fd80:$a: NanoCore 0x40254:$a: NanoCore
17.2.lkjhgfs.exe.3bde6c8.11.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
17.2.lkjhgfs.exe.3bde6c8.11.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
17.2.lkjhgfs.exe.3bde6c8.11.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
17.2.lkjhgfs.exe.3bde6c8.11.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
12.2.RegAsm.exe.5c10000.31.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x13a8:$x1: NanoCore.ClientPluginHost
12.2.RegAsm.exe.5c10000.31.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x13a8:$x2: NanoCore.ClientPluginHost 0x1486:$s4: PipeCreated 0x13c2:$s5: IClientLoggingHost
12.2.RegAsm.exe.5240000.28.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x3f0b:$x1: NanoCore.ClientPluginHost 0x3f44:$x2: IClientNetworkHost
12.2.RegAsm.exe.5240000.28.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x3f0b:$x2: NanoCore.ClientPluginHost 0x400f:$s4: PipeCreated 0x3f25:$s5: IClientLoggingHost
17.2.lkjhgfs.exe.3bde6c8.11.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
17.2.lkjhgfs.exe.3bde6c8.11.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
17.2.lkjhgfs.exe.3bde6c8.11.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
17.2.lkjhgfs.exe.3bde6c8.11.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegAsm.exe.40ad3f1.9.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.40ad3f1.9.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4b96:$a: NanoCore 0x4bbb:$a: NanoCore 0x4c14:$a: NanoCore 0x14db3:$a: NanoCore 0x14dd9:$a: NanoCore 0x14e35:$a: NanoCore 0x21c8c:$a: NanoCore 0x21ce5:$a: NanoCore 0x21d18:$a: NanoCore 0x21f44:$a: NanoCore 0x21fc0:$a: NanoCore 0x225d9:$a: NanoCore 0x22722:$a: NanoCore 0x22bf6:$a: NanoCore 0x22edd:$a: NanoCore 0x22ef4:$a: NanoCore 0x2bd98:$a: NanoCore 0x2be14:$a: NanoCore 0x2e6f7:$a: NanoCore 0x33cc0:$a: NanoCore 0x33d3a:$a: NanoCore
12.2.RegAsm.exe.40cdc52.10.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x16e3:$x1: NanoCore.ClientPluginHost 0xb537:$x1: NanoCore.ClientPluginHost 0x1345f:$x1: NanoCore.ClientPluginHost 0x19432:$x1: NanoCore.ClientPluginHost 0x22ea0:$x1: NanoCore.ClientPluginHost 0x2d2cd:$x1: NanoCore.ClientPluginHost 0x382ac:$x1: NanoCore.ClientPluginHost 0x44050:$x1: NanoCore.ClientPluginHost 0x68f56:$x1: NanoCore.ClientPluginHost 0x78398:$x1: NanoCore.ClientPluginHost 0x9f9a1:$x1: NanoCore.ClientPluginHost 0xa9c6d:$x1: NanoCore.ClientPluginHost 0xbd3db:$x1: NanoCore.ClientPluginHost 0xc72d5:$x1: NanoCore.ClientPluginHost 0xdaa43:$x1: NanoCore.ClientPluginHost 0xe867d:$x1: NanoCore.ClientPluginHost 0x171c:$x2: IClientNetworkHost 0xb570:$x2: IClientNetworkHost 0x13498:$x2: IClientNetworkHost 0x22ffd:$x2: IClientNetworkHost 0x2d306:$x2: IClientNetworkHost
1.2.20014464370.PDF.exe.4304a48.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x381ad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x381ea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x3bd1d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.2.RegAsm.exe.40cdc52.10.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.40cdc52.10.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x142b:$a: NanoCore 0x1484:$a: NanoCore 0x14b7:$a: NanoCore 0x16e3:$a: NanoCore 0x175f:$a: NanoCore 0x1d78:$a: NanoCore 0x1ec1:$a: NanoCore 0x2395:$a: NanoCore 0x267c:$a: NanoCore 0x2693:$a: NanoCore 0xb537:$a: NanoCore 0xb5b3:$a: NanoCore 0xde96:$a: NanoCore 0x1345f:$a: NanoCore 0x134d9:$a: NanoCore 0x18076:$a: NanoCore 0x19432:$a: NanoCore 0x1947c:$a: NanoCore 0x1a0d6:$a: NanoCore 0x22ea0:$a: NanoCore 0x22f8a:$a: NanoCore
12.2.RegAsm.exe.4334738.19.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegAsm.exe.4334738.19.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf763:$a: NanoCore 0xf778:$a: NanoCore 0xf7ad:$a: NanoCore 0x1d3c2:$a: NanoCore 0x1d3e7:$a: NanoCore 0x1d440:$a: NanoCore 0x2d5dd:$a: NanoCore 0x2d603:$a: NanoCore 0x2d65f:$a: NanoCore 0x3a4b4:$a: NanoCore 0x3a50d:$a: NanoCore 0x3a540:$a: NanoCore 0x3a76c:$a: NanoCore 0x3a7e8:$a: NanoCore 0x3ae01:$a: NanoCore 0x3af4a:$a: NanoCore 0x3b41e:$a: NanoCore 0x3b705:$a: NanoCore 0x3b71c:$a: NanoCore 0x40cba:$a: NanoCore 0x40d34:$a: NanoCore
17.2.lkjhgfs.exe.2c7570c.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
17.2.lkjhgfs.exe.2c7570c.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0xe3b7:$s5: IClientLoggingHost
17.2.lkjhgfs.exe.540000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
17.2.lkjhgfs.exe.2c7570c.3.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q 0xf0fc:$j: #=q 0xf118:$j: #=q
15.2.lkjhgfs.exe.3d0e278.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x9138d:$x1: NanoCore.ClientPluginHost 0x913ca:$x2: IClientNetworkHost 0x94efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.20014464370.PDF.exe.4304a48.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x37f25:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x381ad:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x397e6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x397da:$s2: FileCommand 0x1266b:$s3: PipeExists 0x3a68b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x40442:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x381d7:$s5: IClientLoggingHost
17.0.lkjhgfs.exe.540000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
15.2.lkjhgfs.exe.3d0e278.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.20014464370.PDF.exe.4304a48.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
15.2.lkjhgfs.exe.3d0e278.7.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x910f5:$a: NanoCore 0x91105:$a: NanoCore 0x91339:$a: NanoCore 0x9134d:$a: NanoCore 0x9138d:$a: NanoCore 0x91154:$b: ClientPlugin 0x91356:$b: ClientPlugin 0x91396:$b: ClientPlugin 0x9127b:$c: ProjectData 0x91c82:$d: DESCrypto 0x9964e:$e: KeepAlive 0x9763c:$g: LogClientMessage 0x93837:$i: get_Connected 0x91fb8:$j: #=q 0x91fe8:$j: #=q 0x92004:$j: #=q 0x92034:$j: #=q 0x92050:$j: #=q 0x9206c:$j: #=q 0x9209c:$j: #=q 0x920b8:$j: #=q
1.2.20014464370.PDF.exe.4304a48.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x37f15:$a: NanoCore 0x37f25:$a: NanoCore 0x38159:$a: NanoCore 0x3816d:$a: NanoCore 0x381ad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x37f74:$b: ClientPlugin 0x38176:$b: ClientPlugin 0x381b6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x3809b:$c: ProjectData 0x10a82:$d: DESCrypto 0x38aa2:$d: DESCrypto 0x1844e:$e: KeepAlive
12.2.RegAsm.exe.275cabc.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x5ce6e:$a: NanoCore 0x5ce93:$a: NanoCore 0x5ceec:$a: NanoCore 0x6d09f:$a: NanoCore 0x6d0c5:$a: NanoCore 0x6d121:$a: NanoCore 0x79f87:$a: NanoCore 0x79fe0:$a: NanoCore 0x7a013:$a: NanoCore 0x7a23f:$a: NanoCore 0x7a2bb:$a: NanoCore 0x7a8d4:$a: NanoCore 0x7aa1d:$a: NanoCore 0x7aef1:$a: NanoCore 0x7b1d8:$a: NanoCore 0x7b1ef:$a: NanoCore 0x8409f:$a: NanoCore
15.2.lkjhgfs.exe.2ca980c.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
15.2.lkjhgfs.exe.2ca980c.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q 0x10efc:$j: #=q 0x10f18:$j: #=q
Click to see the 267 entries

Sigma Overview

AV Detection:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\RegAsm.exe, ProcessId: 5612, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud:

Sigma detected: NanoCore

Show sources

Source: File created

System Summary:

Sigma detected: Possible Applocker Bypass

Show sources

Source: Process started

Author: juju4: Data: Command: C:\Users\user\AppData\Local\Temp\RegAsm.exe gyujnbgh, CommandLine: C:\Users\user\AppData\Local\Temp\RegAsm.exe gyujnbgh, CommandLine|base64offset|contains: +!, Image: C:\Users\user\AppData\Local\Temp\RegAsm.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\RegAsm.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\RegAsm.exe, ParentCommandLine: 'C:\Users\user\Desktop\20014464370.PDF.exe' , ParentImage: C:\Users\user\Desktop\20014464370.PDF.exe, ParentProcessId: 5480, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\RegAsm.exe gyujnbgh, ProcessId: 5612

Stealing of Sensitive Information:

Sigma detected: NanoCore

Show sources

Source: File created

Remote Access Functionality:

Sigma detected: NanoCore

Show sources

Source: File created

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000017.00000002.498671862.0000000002DA1000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "ba5f434c-3370-4fb7-bec8-4c7f593d", "Group": "Grace", "Domain1": "23.105.131.142", "Domain2": "startedhere.ddns.net", "Port": 2092, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Disable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Disable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Multi AV Scanner detection for domain / URL

Show sources

Source: startedhere.ddns.net

Virustotal: Detection: 8%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\lkjhgfs.exe

ReversingLabs: Detection: 14%

Multi AV Scanner detection for submitted file

Show sources

Source: 20014464370.PDF.exe	Virustotal: Detection: 28%			Perma Link
Source: 20014464370.PDF.exe	ReversingLabs: Detection: 14%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000017.00000000.484413891.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.498671862.0000000002DA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.508139093.0000000004F80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.489565052.0000000003E8E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.504178420.0000000003C2E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.340662970.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.339849220.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.493387609.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.504714336.000000000432F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.498968741.0000000003DA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.504008398.0000000003B8F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.342734107.00000000042DD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.503817122.0000000003FFE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.485173449.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.503247081.0000000003731000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.487979449.0000000003D0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.493405932.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.504360558.00000000041CE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.488625589.0000000003DEF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.503763443.0000000003AAE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.342922605.000000000437C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5612, type: MEMORY
Source: Yara match	File source: Process Memory Space: 20014464370.PDF.exe PID: 5480, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 964, type: MEMORY
Source: Yara match	File source: Process Memory Space: lkjhgfs.exe PID: 5188, type: MEMORY
Source: Yara match	File source: Process Memory Space: lkjhgfs.exe PID: 1848, type: MEMORY
Source: Yara match	File source: 12.2.RegAsm.exe.4f80000.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41d3b98.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.432ca68.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.437ca88.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4334738.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bb66a8.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3deff64.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3deb12e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3c2e6e8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.437ca88.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e8e6e8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3c2e6e8.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.4304a48.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41d81c1.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.377ff64.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3deff64.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4f84629.23.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4f80000.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3aae278.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e8e6e8.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e3e6c8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bb66a8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41ced62.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.378458d.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3df458d.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4338d61.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e166a8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.432ca68.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e166a8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e3e6c8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.377b12e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.41fc618.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.377ff64.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41d3b98.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.40b9625.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.432f902.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bde6c8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bde6c8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.40ad3f1.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.40cdc52.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4334738.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3d0e278.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.4304a48.6.raw.unpack, type: UNPACKEDPE

Source: 12.2.RegAsm.exe.4f80000.22.unpack	Avira: Label: TR/NanoCore.fadte
Source: 23.0.RegAsm.exe.400000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 23.2.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 23.0.RegAsm.exe.400000.3.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.RegAsm.exe.400000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.2.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.RegAsm.exe.400000.3.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Source: 20014464370.PDF.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: 20014464370.PDF.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: RegAsm.pdb source: RegAsm.exe, RegAsm.exe.1.dr
Source:	Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\MyNanoCore RemoteScripting\MyClientPlugin\obj\Debug\MyClientPluginNew.pdb source: RegAsm.exe, 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 0000000C.00000002.493736550.0000000000442000.00000002.00020000.sdmp, RegAsm.exe, 00000017.00000002.493683200.0000000000A42000.00000002.00020000.sdmp, RegAsm.exe.1.dr
Source:	Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: RegAsm.exe, 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: RegAsm.exe, 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp
Source:	Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: RegAsm.exe, 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp
Source:	Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: RegAsm.exe, 0000000C.00000002.508963267.0000000006520000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: RegAsm.exe, 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp

Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 4x nop then jmp 0311BC71h	1_2_0311B898
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	1_2_03111110
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	1_2_03111105
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 4x nop then jmp 05AD5DA4h	1_2_05AD5DD0
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 7FFFFFFFh	1_2_05ADC938
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	1_2_05ADC820
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 4x nop then jmp 05AD5DA4h	1_2_05AD5E19
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	12_2_05C0A2B0
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	12_2_05C0A439
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	12_2_05C0A2A0
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 4x nop then jmp 0505BC71h	15_2_0505B898
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	15_2_05051105
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	15_2_05051110
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 7FFFFFFFh	15_2_0533C830
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	15_2_0533C718
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 4x nop then jmp 0291BC71h	17_2_0291B898
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	17_2_02911110
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	17_2_02911105
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 7FFFFFFFh	17_2_050AC830
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	17_2_050AC718

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49730 -> 23.105.131.142:2092

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: startedhere.ddns.net
Source: Malware configuration extractor	URLs: 23.105.131.142

Source: global traffic

TCP traffic: 192.168.2.5:49730 -> 23.105.131.142:2092

Source: Joe Sandbox View

IP Address: 23.105.131.142 23.105.131.142

Source: Joe Sandbox View

ASN Name: LEASEWEB-USA-NYC-11US LEASEWEB-USA-NYC-11US

Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142
Source: unknown	TCP traffic detected without corresponding DNS query: 23.105.131.142

Source: 20014464370.PDF.exe	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: 20014464370.PDF.exe	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: 20014464370.PDF.exe	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: 20014464370.PDF.exe	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: 20014464370.PDF.exe	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: 20014464370.PDF.exe	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: RegAsm.exe, 0000000C.00000002.508963267.0000000006520000.00000004.00000001.sdmp	String found in binary or memory: http://google.com
Source: 20014464370.PDF.exe	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: 20014464370.PDF.exe	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: 20014464370.PDF.exe	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: 20014464370.PDF.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: 20014464370.PDF.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: 20014464370.PDF.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: lkjhgfs.exe, AAAstarupxxzzzgb.exe, 20014464370.PDF.exe	String found in binary or memory: http://us1.unwiredlabs.com/v2/process.php
Source: RegAsm.exe, 0000000C.00000002.509338103.0000000006C1C000.00000004.00000001.sdmp, AAAstarupxxzzzgb.exe.12.dr	String found in binary or memory: http://us1.unwiredlabs.com/v2/process.php?application/json;
Source: 20014464370.PDF.exe	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 20014464370.PDF.exe	String found in binary or memory: https://www.globalsign.com/repository/03
Source: 20014464370.PDF.exe	String found in binary or memory: https://www.globalsign.com/repository/06

Source: lkjhgfs.exe, 0000000F.00000002.486391031.0000000000E69000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: RegAsm.exe, 0000000C.00000002.504714336.000000000432F000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000017.00000000.484413891.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.498671862.0000000002DA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.508139093.0000000004F80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.489565052.0000000003E8E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.504178420.0000000003C2E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.340662970.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.339849220.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.493387609.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.504714336.000000000432F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.498968741.0000000003DA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.504008398.0000000003B8F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.342734107.00000000042DD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.503817122.0000000003FFE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.485173449.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.503247081.0000000003731000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.487979449.0000000003D0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.493405932.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.504360558.00000000041CE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.488625589.0000000003DEF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.503763443.0000000003AAE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.342922605.000000000437C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5612, type: MEMORY
Source: Yara match	File source: Process Memory Space: 20014464370.PDF.exe PID: 5480, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 964, type: MEMORY
Source: Yara match	File source: Process Memory Space: lkjhgfs.exe PID: 5188, type: MEMORY
Source: Yara match	File source: Process Memory Space: lkjhgfs.exe PID: 1848, type: MEMORY
Source: Yara match	File source: 12.2.RegAsm.exe.4f80000.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41d3b98.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.432ca68.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.437ca88.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4334738.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bb66a8.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3deff64.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3deb12e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3c2e6e8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.437ca88.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e8e6e8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3c2e6e8.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.4304a48.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41d81c1.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.377ff64.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3deff64.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4f84629.23.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4f80000.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3aae278.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e8e6e8.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e3e6c8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bb66a8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41ced62.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.378458d.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3df458d.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4338d61.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e166a8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.432ca68.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e166a8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e3e6c8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.377b12e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.41fc618.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.377ff64.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41d3b98.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.40b9625.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.432f902.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bde6c8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bde6c8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.40ad3f1.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.40cdc52.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4334738.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3d0e278.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.4304a48.6.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0000000C.00000002.508404585.0000000005220000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.509028437.0000000006560000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000017.00000000.484413891.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000017.00000000.484413891.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.508963267.0000000006520000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.508342634.00000000051F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.508356430.0000000005200000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000017.00000002.498671862.0000000002DA1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.508139093.0000000004F80000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000F.00000002.489565052.0000000003E8E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000F.00000002.489565052.0000000003E8E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000011.00000002.499016642.00000000029A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000011.00000002.499016642.00000000029A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000011.00000002.504178420.0000000003C2E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000011.00000002.504178420.0000000003C2E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000F.00000002.486837759.0000000002C00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000F.00000002.486837759.0000000002C00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000000.340662970.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.340662970.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000000.339849220.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.339849220.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000017.00000002.493387609.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000017.00000002.493387609.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.508978041.0000000006530000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.508467673.0000000005250000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.504714336.000000000432F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000017.00000002.498968741.0000000003DA9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.508108370.0000000004F70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.509043380.0000000006570000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000011.00000002.504008398.0000000003B8F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000011.00000002.504008398.0000000003B8F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.342734107.00000000042DD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.342734107.00000000042DD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.503817122.0000000003FFE000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.508990820.0000000006540000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000017.00000000.485173449.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000017.00000000.485173449.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.503247081.0000000003731000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.508451814.0000000005240000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000F.00000002.487979449.0000000003D0E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000F.00000002.487979449.0000000003D0E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.493405932.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.493405932.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.508629806.0000000005C10000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.504360558.00000000041CE000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000F.00000002.488625589.0000000003DEF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000F.00000002.488625589.0000000003DEF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.509088108.00000000065B0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000011.00000002.503763443.0000000003AAE000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000011.00000002.503763443.0000000003AAE000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.342922605.000000000437C000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.342922605.000000000437C000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.504504197.0000000004244000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: RegAsm.exe PID: 5612, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: RegAsm.exe PID: 5612, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 20014464370.PDF.exe PID: 5480, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: 20014464370.PDF.exe PID: 5480, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: RegAsm.exe PID: 964, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: RegAsm.exe PID: 964, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: lkjhgfs.exe PID: 5188, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: lkjhgfs.exe PID: 5188, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: lkjhgfs.exe PID: 1848, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: lkjhgfs.exe PID: 1848, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.6560000.35.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.4f80000.22.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.42a943e.15.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.65b0000.39.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.41d3b98.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.20014464370.PDF.exe.432ca68.7.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.20014464370.PDF.exe.432ca68.7.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.20014464370.PDF.exe.437ca88.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.20014464370.PDF.exe.437ca88.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.6570000.38.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.lkjhgfs.exe.2ca980c.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.lkjhgfs.exe.2ca980c.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.65b0000.39.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.4334738.19.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.lkjhgfs.exe.3bb66a8.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.lkjhgfs.exe.3bb66a8.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.27b4d94.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.6530000.33.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.2.RegAsm.exe.3deff64.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.40b9625.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.2.RegAsm.exe.3deb12e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.2.RegAsm.exe.3deb12e.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.5200000.26.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.5220000.27.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.42b786e.16.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.27c0fdc.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.5250000.29.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.lkjhgfs.exe.3c2e6e8.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.lkjhgfs.exe.3c2e6e8.12.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 23.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.5240000.28.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.4f70000.21.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.20014464370.PDF.exe.437ca88.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.20014464370.PDF.exe.437ca88.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.lkjhgfs.exe.3e8e6e8.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.lkjhgfs.exe.3e8e6e8.10.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 23.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 17.2.lkjhgfs.exe.3c2e6e8.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.lkjhgfs.exe.3c2e6e8.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.42a943e.15.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.20014464370.PDF.exe.4304a48.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.20014464370.PDF.exe.4304a48.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.41d81c1.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.41d81c1.13.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.40ad3f1.9.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.6540000.34.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.377ff64.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.2.RegAsm.exe.3deff64.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.27b4d94.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.27b4d94.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.4f84629.23.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.4f80000.22.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.5200000.26.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.lkjhgfs.exe.3aae278.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.lkjhgfs.exe.3aae278.9.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.lkjhgfs.exe.3e8e6e8.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.lkjhgfs.exe.3e8e6e8.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.lkjhgfs.exe.3e3e6c8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.lkjhgfs.exe.3e3e6c8.9.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.lkjhgfs.exe.3bb66a8.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 17.2.lkjhgfs.exe.3bb66a8.10.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 23.2.RegAsm.exe.2e09670.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.6520000.32.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.6560000.35.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.41ced62.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.41ced62.11.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.378458d.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.42b786e.16.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.6540000.34.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.2.RegAsm.exe.3df458d.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.4338d61.18.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.51f0000.25.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.lkjhgfs.exe.3e166a8.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.lkjhgfs.exe.3e166a8.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.20014464370.PDF.exe.432ca68.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.20014464370.PDF.exe.432ca68.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.6570000.38.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.5250000.29.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.6520000.32.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.51f0000.25.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.42a060f.14.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.42a060f.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.42a060f.14.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.6574c9f.36.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.lkjhgfs.exe.3e166a8.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.lkjhgfs.exe.3e166a8.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.lkjhgfs.exe.3e3e6c8.9.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.lkjhgfs.exe.3e3e6c8.9.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.6530000.33.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.377b12e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.377b12e.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.20014464370.PDF.exe.41fc618.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.20014464370.PDF.exe.41fc618.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.27c0fdc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.27c0fdc.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.377ff64.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.41d3b98.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.lkjhgfs.exe.2c7570c.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.40b9625.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.657e8a4.37.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.lkjhgfs.exe.2c7570c.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.41d3b98.12.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.432f902.17.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 17.2.lkjhgfs.exe.3bde6c8.11.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.lkjhgfs.exe.3bde6c8.11.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.5c10000.31.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.5240000.28.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.lkjhgfs.exe.3bde6c8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.lkjhgfs.exe.3bde6c8.11.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.40ad3f1.9.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.40cdc52.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.20014464370.PDF.exe.4304a48.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegAsm.exe.40cdc52.10.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.4334738.19.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 17.2.lkjhgfs.exe.2c7570c.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.lkjhgfs.exe.2c7570c.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.lkjhgfs.exe.3d0e278.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.lkjhgfs.exe.3d0e278.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.20014464370.PDF.exe.4304a48.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegAsm.exe.275cabc.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 15.2.lkjhgfs.exe.2ca980c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.lkjhgfs.exe.2ca980c.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: 20014464370.PDF.exe

Source: C:\Users\user\Desktop\20014464370.PDF.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_015F3338	1_2_015F3338
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_015F3328	1_2_015F3328
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_0311BDF8	1_2_0311BDF8
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_03111973	1_2_03111973
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_03111980	1_2_03111980
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_05AD5630	1_2_05AD5630
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_05AD7430	1_2_05AD7430
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_05AD0006	1_2_05AD0006
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_05AD0040	1_2_05AD0040
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_05AD7390	1_2_05AD7390
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_05AD73EB	1_2_05AD73EB
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_05AD4F09	1_2_05AD4F09
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_05AD4F18	1_2_05AD4F18
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_05AD5621	1_2_05AD5621
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_00443DFE	12_2_00443DFE
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_065C1800	12_2_065C1800
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_065B46D3	12_2_065B46D3
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_065C36F0	12_2_065C36F0
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_065B42EB	12_2_065B42EB
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_065B3324	12_2_065B3324
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_04C1E480	12_2_04C1E480
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_04C1E471	12_2_04C1E471
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_04C1BBD4	12_2_04C1BBD4
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_05C0E770	12_2_05C0E770
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_05C071D8	12_2_05C071D8
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_05C08048	12_2_05C08048
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_05C0F388	12_2_05C0F388
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_05C0F446	12_2_05C0F446
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_05C08106	12_2_05C08106
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_05C08928	12_2_05C08928
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_06AA0F70	12_2_06AA0F70
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_011F3338	15_2_011F3338
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_011F3328	15_2_011F3328
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_011F37E8	15_2_011F37E8
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_0505BDF8	15_2_0505BDF8
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_05051972	15_2_05051972
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_05051980	15_2_05051980
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_05335630	15_2_05335630
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_05330006	15_2_05330006
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_05330040	15_2_05330040
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_05337320	15_2_05337320
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_05334F18	15_2_05334F18
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_05334F09	15_2_05334F09
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_05334BCA	15_2_05334BCA
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_05335621	15_2_05335621
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_05337280	15_2_05337280
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_01033328	17_2_01033328
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_01033338	17_2_01033338
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_0291BDF8	17_2_0291BDF8
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_02911980	17_2_02911980
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_02911972	17_2_02911972
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_050A5630	17_2_050A5630
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_050A0006	17_2_050A0006
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_050A0040	17_2_050A0040
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_050A731B	17_2_050A731B
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_050A4F18	17_2_050A4F18
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_050A4F17	17_2_050A4F17
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_050A7320	17_2_050A7320
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_050A562F	17_2_050A562F
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 23_2_00A43DFE	23_2_00A43DFE
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 23_2_0530F5F8	23_2_0530F5F8
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 23_2_05309788	23_2_05309788
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 23_2_0530A580	23_2_0530A580
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 23_2_0530A5D0	23_2_0530A5D0
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 23_2_05593E30	23_2_05593E30
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 23_2_05594A50	23_2_05594A50
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 23_2_05594B08	23_2_05594B08

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\RegAsm.exe FFE4480CCC81B061F725C54587E9D1BA96547D27FE28083305D75796F2EB3E74

Source: 20014464370.PDF.exe

Static PE information: invalid certificate

Source: 20014464370.PDF.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: lkjhgfs.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AAAstarupxxzzzgb.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AAAstarupxxzzzgb.exe.12.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: 20014464370.PDF.exe, 00000001.00000002.341134518.0000000000E98000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameaanjkcxzs.exe@ vs 20014464370.PDF.exe
Source: 20014464370.PDF.exe, 00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameWzyjcirkq.dll" vs 20014464370.PDF.exe
Source: 20014464370.PDF.exe, 00000001.00000002.345363634.00000000058A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs 20014464370.PDF.exe
Source: 20014464370.PDF.exe, 00000001.00000002.341859487.0000000003161000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs 20014464370.PDF.exe
Source: 20014464370.PDF.exe, 00000001.00000002.345151540.00000000057D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs 20014464370.PDF.exe
Source: 20014464370.PDF.exe, 00000001.00000002.341830594.0000000003140000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs 20014464370.PDF.exe
Source: 20014464370.PDF.exe, 00000001.00000002.341818310.0000000003120000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dllj% vs 20014464370.PDF.exe
Source: 20014464370.PDF.exe	Binary or memory string: OriginalFilenameaanjkcxzs.exe@ vs 20014464370.PDF.exe

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Section loaded: sfc.dll			Jump to behavior

Source: 20014464370.PDF.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: 0000000C.00000002.508404585.0000000005220000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.508404585.0000000005220000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000C.00000002.509028437.0000000006560000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.509028437.0000000006560000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000017.00000000.484413891.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000017.00000000.484413891.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.508963267.0000000006520000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.508963267.0000000006520000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000C.00000002.508342634.00000000051F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.508342634.00000000051F0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000C.00000002.508356430.0000000005200000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.508356430.0000000005200000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000017.00000002.498671862.0000000002DA1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.508139093.0000000004F80000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.508139093.0000000004F80000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000F.00000002.489565052.0000000003E8E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000F.00000002.489565052.0000000003E8E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000011.00000002.499016642.00000000029A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000011.00000002.499016642.00000000029A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000011.00000002.504178420.0000000003C2E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000011.00000002.504178420.0000000003C2E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000F.00000002.486837759.0000000002C00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000F.00000002.486837759.0000000002C00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000000.340662970.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000000.340662970.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000000.339849220.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000000.339849220.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000017.00000002.493387609.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000017.00000002.493387609.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.508978041.0000000006530000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.508978041.0000000006530000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000C.00000002.508467673.0000000005250000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.508467673.0000000005250000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000C.00000002.504714336.000000000432F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000017.00000002.498968741.0000000003DA9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.508108370.0000000004F70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.508108370.0000000004F70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000C.00000002.509043380.0000000006570000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.509043380.0000000006570000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000011.00000002.504008398.0000000003B8F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000011.00000002.504008398.0000000003B8F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000002.342734107.00000000042DD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.342734107.00000000042DD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.503817122.0000000003FFE000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.508990820.0000000006540000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.508990820.0000000006540000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000017.00000000.485173449.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000017.00000000.485173449.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.503247081.0000000003731000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.508451814.0000000005240000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.508451814.0000000005240000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000F.00000002.487979449.0000000003D0E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000F.00000002.487979449.0000000003D0E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.493405932.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.493405932.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.508629806.0000000005C10000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.508629806.0000000005C10000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000C.00000002.504360558.00000000041CE000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000F.00000002.488625589.0000000003DEF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000F.00000002.488625589.0000000003DEF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.509088108.00000000065B0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.509088108.00000000065B0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000011.00000002.503763443.0000000003AAE000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000011.00000002.503763443.0000000003AAE000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000002.342922605.000000000437C000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.342922605.000000000437C000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.504504197.0000000004244000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: RegAsm.exe PID: 5612, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: RegAsm.exe PID: 5612, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: 20014464370.PDF.exe PID: 5480, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: 20014464370.PDF.exe PID: 5480, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: RegAsm.exe PID: 964, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: RegAsm.exe PID: 964, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: lkjhgfs.exe PID: 5188, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: lkjhgfs.exe PID: 5188, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: lkjhgfs.exe PID: 1848, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: lkjhgfs.exe PID: 1848, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.6560000.35.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.6560000.35.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.4f80000.22.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.4f80000.22.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.42a943e.15.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.42a943e.15.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.65b0000.39.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.65b0000.39.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.41d3b98.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.41d3b98.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.20014464370.PDF.exe.432ca68.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.20014464370.PDF.exe.432ca68.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.20014464370.PDF.exe.432ca68.7.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.20014464370.PDF.exe.437ca88.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.20014464370.PDF.exe.437ca88.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.20014464370.PDF.exe.437ca88.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.6570000.38.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.6570000.38.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.lkjhgfs.exe.2ca980c.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.lkjhgfs.exe.2ca980c.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.lkjhgfs.exe.2ca980c.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.65b0000.39.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.65b0000.39.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.4334738.19.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.4334738.19.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.lkjhgfs.exe.3bb66a8.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.lkjhgfs.exe.3bb66a8.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.lkjhgfs.exe.3bb66a8.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.27b4d94.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.27b4d94.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.6530000.33.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.6530000.33.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.2.RegAsm.exe.3deff64.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 23.2.RegAsm.exe.3deff64.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.40b9625.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.40b9625.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.2.RegAsm.exe.3deb12e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 23.2.RegAsm.exe.3deb12e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.2.RegAsm.exe.3deb12e.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.5200000.26.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.5200000.26.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.5220000.27.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.5220000.27.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.42b786e.16.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.42b786e.16.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.27c0fdc.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.27c0fdc.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.5250000.29.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.5250000.29.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.lkjhgfs.exe.3c2e6e8.12.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.lkjhgfs.exe.3c2e6e8.12.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.lkjhgfs.exe.3c2e6e8.12.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 23.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 23.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.5240000.28.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.5240000.28.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.4f70000.21.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.4f70000.21.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.20014464370.PDF.exe.437ca88.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.20014464370.PDF.exe.437ca88.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.20014464370.PDF.exe.437ca88.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 15.2.lkjhgfs.exe.3e8e6e8.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.lkjhgfs.exe.3e8e6e8.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.lkjhgfs.exe.3e8e6e8.10.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 23.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 23.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 17.2.lkjhgfs.exe.3c2e6e8.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.lkjhgfs.exe.3c2e6e8.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.lkjhgfs.exe.3c2e6e8.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.42a943e.15.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.42a943e.15.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.20014464370.PDF.exe.4304a48.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.20014464370.PDF.exe.4304a48.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.20014464370.PDF.exe.4304a48.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.41d81c1.13.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.41d81c1.13.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.41d81c1.13.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.40ad3f1.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.40ad3f1.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.6540000.34.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.6540000.34.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 23.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.377ff64.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.377ff64.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.2.RegAsm.exe.3deff64.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 23.2.RegAsm.exe.3deff64.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.27b4d94.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.27b4d94.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.4f84629.23.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.4f84629.23.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.4f80000.22.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.4f80000.22.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.5200000.26.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.5200000.26.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.lkjhgfs.exe.3aae278.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.lkjhgfs.exe.3aae278.9.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 15.2.lkjhgfs.exe.3e8e6e8.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.lkjhgfs.exe.3e8e6e8.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.lkjhgfs.exe.3e8e6e8.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 15.2.lkjhgfs.exe.3e3e6c8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.lkjhgfs.exe.3e3e6c8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.lkjhgfs.exe.3e3e6c8.9.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.lkjhgfs.exe.3bb66a8.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.lkjhgfs.exe.3bb66a8.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 17.2.lkjhgfs.exe.3bb66a8.10.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 23.2.RegAsm.exe.2e09670.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 23.2.RegAsm.exe.2e09670.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.6520000.32.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.6520000.32.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.6560000.35.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.6560000.35.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.41ced62.11.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.41ced62.11.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.41ced62.11.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.378458d.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.378458d.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.42b786e.16.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.42b786e.16.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.6540000.34.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.6540000.34.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 23.2.RegAsm.exe.3df458d.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 23.2.RegAsm.exe.3df458d.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.4338d61.18.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.51f0000.25.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.51f0000.25.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.lkjhgfs.exe.3e166a8.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.lkjhgfs.exe.3e166a8.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.lkjhgfs.exe.3e166a8.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.20014464370.PDF.exe.432ca68.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.20014464370.PDF.exe.432ca68.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.20014464370.PDF.exe.432ca68.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.6570000.38.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.6570000.38.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.5250000.29.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.5250000.29.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.6520000.32.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.6520000.32.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.51f0000.25.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.51f0000.25.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.42a060f.14.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.42a060f.14.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.42a060f.14.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.42a060f.14.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.42a060f.14.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.6574c9f.36.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.6574c9f.36.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.lkjhgfs.exe.3e166a8.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.lkjhgfs.exe.3e166a8.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.lkjhgfs.exe.3e166a8.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 15.2.lkjhgfs.exe.3e3e6c8.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.lkjhgfs.exe.3e3e6c8.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.lkjhgfs.exe.3e3e6c8.9.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.6530000.33.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.6530000.33.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.377b12e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.377b12e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.377b12e.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.20014464370.PDF.exe.41fc618.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.20014464370.PDF.exe.41fc618.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.27c0fdc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.27c0fdc.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.377ff64.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.377ff64.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.41d3b98.12.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.41d3b98.12.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.lkjhgfs.exe.2c7570c.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.40b9625.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.657e8a4.37.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.657e8a4.37.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.lkjhgfs.exe.2c7570c.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.lkjhgfs.exe.2c7570c.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.41d3b98.12.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.432f902.17.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 17.2.lkjhgfs.exe.3bde6c8.11.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.lkjhgfs.exe.3bde6c8.11.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.lkjhgfs.exe.3bde6c8.11.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.5c10000.31.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.5c10000.31.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegAsm.exe.5240000.28.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.5240000.28.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.lkjhgfs.exe.3bde6c8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.lkjhgfs.exe.3bde6c8.11.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.lkjhgfs.exe.3bde6c8.11.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.40ad3f1.9.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.40cdc52.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.20014464370.PDF.exe.4304a48.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegAsm.exe.40cdc52.10.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.4334738.19.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 17.2.lkjhgfs.exe.2c7570c.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.lkjhgfs.exe.2c7570c.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.lkjhgfs.exe.2c7570c.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 15.2.lkjhgfs.exe.3d0e278.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.20014464370.PDF.exe.4304a48.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.lkjhgfs.exe.3d0e278.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.20014464370.PDF.exe.4304a48.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegAsm.exe.275cabc.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 15.2.lkjhgfs.exe.2ca980c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 15.2.lkjhgfs.exe.2ca980c.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: 20014464370.PDF.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: lkjhgfs.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: AAAstarupxxzzzgb.exe.12.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 12.0.RegAsm.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 12.0.RegAsm.exe.400000.1.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 12.0.RegAsm.exe.400000.1.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.0.RegAsm.exe.400000.3.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 12.0.RegAsm.exe.400000.3.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.0.RegAsm.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 12.0.RegAsm.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.0.RegAsm.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.0.RegAsm.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.0.RegAsm.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: classification engine

Classification label: mal100.troj.evad.winEXE@9/10@0/1

Source: C:\Users\user\Desktop\20014464370.PDF.exe

File created: C:\Users\user\AppData\Local\lkjhgfs.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\{ba5f434c-3370-4fb7-bec8-4c7f593d07f3}

Source: C:\Users\user\Desktop\20014464370.PDF.exe

File created: C:\Users\user\AppData\Local\Temp\RegAsm.exe

Jump to behavior

Source: 20014464370.PDF.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\20014464370.PDF.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\20014464370.PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 20014464370.PDF.exe	Virustotal: Detection: 28%
Source: 20014464370.PDF.exe	ReversingLabs: Detection: 14%

Source: C:\Users\user\Desktop\20014464370.PDF.exe

File read: C:\Users\user\Desktop\20014464370.PDF.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\20014464370.PDF.exe 'C:\Users\user\Desktop\20014464370.PDF.exe'
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exe gyujnbgh
Source: unknown	Process created: C:\Users\user\AppData\Local\lkjhgfs.exe 'C:\Users\user\AppData\Local\lkjhgfs.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\lkjhgfs.exe 'C:\Users\user\AppData\Local\lkjhgfs.exe'
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe 'C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe'
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exe gyujnbgh
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exe gyujnbgh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe 'C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exe gyujnbgh	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\20014464370.PDF.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 20014464370.PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 20014464370.PDF.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: RegAsm.pdb source: RegAsm.exe, RegAsm.exe.1.dr
Source:	Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\MyNanoCore RemoteScripting\MyClientPlugin\obj\Debug\MyClientPluginNew.pdb source: RegAsm.exe, 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 0000000C.00000002.493736550.0000000000442000.00000002.00020000.sdmp, RegAsm.exe, 00000017.00000002.493683200.0000000000A42000.00000002.00020000.sdmp, RegAsm.exe.1.dr
Source:	Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: RegAsm.exe, 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: RegAsm.exe, 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp
Source:	Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: RegAsm.exe, 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp
Source:	Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: RegAsm.exe, 0000000C.00000002.508963267.0000000006520000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: RegAsm.exe, 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 20014464370.PDF.exe, Nakdaea.Messages/Class.cs	.Net Code: ConnectClass System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: lkjhgfs.exe.1.dr, Nakdaea.Messages/Class.cs	.Net Code: ConnectClass System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.20014464370.PDF.exe.e10000.0.unpack, Nakdaea.Messages/Class.cs	.Net Code: ConnectClass System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.20014464370.PDF.exe.e10000.0.unpack, Nakdaea.Messages/Class.cs	.Net Code: ConnectClass System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.RegAsm.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.RegAsm.exe.400000.1.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.RegAsm.exe.400000.3.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.RegAsm.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 15.2.lkjhgfs.exe.7b0000.0.unpack, Nakdaea.Messages/Class.cs	.Net Code: ConnectClass System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 15.0.lkjhgfs.exe.7b0000.0.unpack, Nakdaea.Messages/Class.cs	.Net Code: ConnectClass System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 17.2.lkjhgfs.exe.540000.0.unpack, Nakdaea.Messages/Class.cs	.Net Code: ConnectClass System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Yara detected Costura Assembly Loader

Show sources

Source: Yara match	File source: 20014464370.PDF.exe, type: SAMPLE
Source: Yara match	File source: 00000011.00000000.377243556.0000000000542000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.359197318.00000000007B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.341859487.0000000003161000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.493302996.0000000000542000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.497639798.0000000002441000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.493379288.0000000000052000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.218918618.0000000000E12000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.486775398.0000000002BB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.485697797.00000000007B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.453300542.0000000000052000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.509338103.0000000006C1C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.498841834.0000000002951000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.341051840.0000000000E12000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5612, type: MEMORY
Source: Yara match	File source: Process Memory Space: 20014464370.PDF.exe PID: 5480, type: MEMORY
Source: Yara match	File source: Process Memory Space: AAAstarupxxzzzgb.exe PID: 3604, type: MEMORY
Source: Yara match	File source: Process Memory Space: lkjhgfs.exe PID: 5188, type: MEMORY
Source: Yara match	File source: Process Memory Space: lkjhgfs.exe PID: 1848, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\lkjhgfs.exe, type: DROPPED
Source: Yara match	File source: 22.0.AAAstarupxxzzzgb.exe.50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.6cd305a.42.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.AAAstarupxxzzzgb.exe.50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.6cd305a.42.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.lkjhgfs.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.20014464370.PDF.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.6d5a9f0.41.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.6d5a9f0.41.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.lkjhgfs.exe.540000.0.unpack, type: UNPACKEDPE

Source: AAAstarupxxzzzgb.exe.12.dr

Static PE information: 0xED5163A4 [Fri Mar 2 13:41:56 2096 UTC]

Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_00E13CD5 push esp; iretd	1_2_00E13CD8
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_00E138DA push esp; iretd	1_2_00E138DD
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_03114D40 pushad ; iretd	1_2_03114D41
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_03114D46 push ecx; iretd	1_2_03114D47
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Code function: 1_2_031161EC push eax; iretd	1_2_031161ED
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_00444289 push es; retf	12_2_00444294
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_004444A3 push es; retf	12_2_004444A4
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_00444469 push cs; retf	12_2_0044449E
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_04C1E349 pushad ; ret	12_2_04C1E356
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_04C169B0 pushfd ; retn 0004h	12_2_04C169B1
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 12_2_05C0ADED push 8B000005h; retf	12_2_05C0ADF7
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_007B38DA push esp; iretd	15_2_007B38DD
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_007B3CD5 push esp; iretd	15_2_007B3CD8
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_05054D46 push ecx; iretd	15_2_05054D47
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_05054D40 pushad ; iretd	15_2_05054D41
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_050561EC push eax; iretd	15_2_050561ED
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 15_2_05338528 push esp; iretd	15_2_05338529
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_00543CD5 push esp; iretd	17_2_00543CD8
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_005438DA push esp; iretd	17_2_005438DD
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_029161EC push eax; iretd	17_2_029161ED
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_02914D40 pushad ; iretd	17_2_02914D41
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Code function: 17_2_02914D46 push ecx; iretd	17_2_02914D47
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 23_2_00A444A3 push es; retf	23_2_00A444A4
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 23_2_00A44469 push cs; retf	23_2_00A4449E
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 23_2_00A44289 push es; retf	23_2_00A44294
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 23_2_053069F8 pushad ; retf	23_2_053069F9
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Code function: 23_2_053069FA push esp; retf	23_2_05306A01

Source: initial sample	Static PE information: section name: .text entropy: 7.98698784379
Source: initial sample	Static PE information: section name: .text entropy: 7.98698784379
Source: initial sample	Static PE information: section name: .text entropy: 7.99215035328

Source: 12.0.RegAsm.exe.400000.1.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 12.0.RegAsm.exe.400000.1.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 12.2.RegAsm.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 12.0.RegAsm.exe.400000.3.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 12.0.RegAsm.exe.400000.3.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\20014464370.PDF.exe	File created: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Jump to dropped file
Source: C:\Users\user\Desktop\20014464370.PDF.exe	File created: C:\Users\user\AppData\Local\lkjhgfs.exe	Jump to dropped file

Source: C:\Users\user\Desktop\20014464370.PDF.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run lkjhgfs			Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run lkjhgfs			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Uses an obfuscated file name to hide its real file extension (double extension)

Show sources

Source: Possible double extension: pdf.exe

Static PE information: 20014464370.PDF.exe

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 20014464370.PDF.exe, 00000001.00000002.341859487.0000000003161000.00000004.00000001.sdmp, lkjhgfs.exe, 0000000F.00000002.486775398.0000000002BB1000.00000004.00000001.sdmp, lkjhgfs.exe, 00000011.00000002.498841834.0000000002951000.00000004.00000001.sdmp

Binary or memory string: SBIEDLL.DLL0SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE

Source: C:\Users\user\AppData\Local\lkjhgfs.exe	File opened / queried: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lkjhgfs.exe.log	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	File opened / queried: C:\Users\user\AppData\Local\lkjhgfs.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	File opened / queried: C:\Users\user\AppData\Local\lkjhgfs.exe.config	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	File opened / queried: C:\Users\user\AppData\Local\lkjhgfs.INI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}	Jump to behavior

Source: C:\Users\user\Desktop\20014464370.PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Window / User API: threadDelayed 5379	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Window / User API: threadDelayed 4241	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Window / User API: foregroundWindowGot 356	Jump to behavior

Source: C:\Users\user\Desktop\20014464370.PDF.exe TID: 3976	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 1260	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe TID: 4112	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\20014464370.PDF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: lkjhgfs.exe, 0000000F.00000002.486371354.0000000000E60000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\C:\Users\user\AppData\Local\lkjhgfs.exe"C:\Users\user\AppData\Local\lkjhgfs.exe" C:\Users\user\AppData\Local\lkjhgfs.exeWinsta0\Default=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=computerComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=5507ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=computerUSERDOMAIN_ROAMINGPROFILE=computerUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsH
Source: lkjhgfs.exe, 00000011.00000002.498841834.0000000002951000.00000004.00000001.sdmp	Binary or memory string: 0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: lkjhgfs.exe, 00000011.00000002.497543143.0000000000CF0000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\lkjhgfs.exeFraxk
Source: lkjhgfs.exe, 0000000F.00000002.486371354.0000000000E60000.00000004.00000020.sdmp	Binary or memory string: C:\Windows\Temp\AslLog_ShimDebugLog_lkjhgfs.exe_1848.txt
Source: lkjhgfs.exe, 0000000F.00000002.486391031.0000000000E69000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lkjhgfs.exe.log$
Source: RegAsm.exe, 0000000C.00000003.491770555.0000000006299000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exe@
Source: lkjhgfs.exe, 0000000F.00000002.486837759.0000000002C00000.00000004.00000001.sdmp, lkjhgfs.exe, 00000011.00000002.499016642.00000000029A0000.00000004.00000001.sdmp	Binary or memory string: l)C:\Users\user\AppData\Local\lkjhgfs.exex
Source: RegAsm.exe, 0000000C.00000002.504987009.000000000453F000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exeP
Source: lkjhgfs.exe, 0000000F.00000002.486485227.0000000000EE5000.00000004.00000020.sdmp	Binary or memory string: \Users\user\AppData\Local\lkjhgfs.exeiJZl
Source: lkjhgfs.exe, 00000011.00000002.497605970.0000000000CFA000.00000004.00000020.sdmp	Binary or memory string: lkjhgfs.exenDefi
Source: RegAsm.exe, 0000000C.00000003.379211169.0000000005B1B000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exe"
Source: lkjhgfs.exe, 0000000F.00000002.486448464.0000000000EB0000.00000004.00000020.sdmp	Binary or memory string: lkjhgfs.exeMrl.exe
Source: lkjhgfs.exe, 0000000F.00000002.486371354.0000000000E60000.00000004.00000020.sdmp	Binary or memory string: C:\Windows\Temp\AslLog_ApphelpDebug_lkjhgfs.exe_1848.txt G
Source: lkjhgfs.exe, 00000011.00000002.497816109.0000000000D24000.00000004.00000020.sdmp	Binary or memory string: \??\C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lkjhgfs.exe.log(
Source: lkjhgfs.exe, 0000000F.00000002.486837759.0000000002C00000.00000004.00000001.sdmp, lkjhgfs.exe, 00000011.00000002.499016642.00000000029A0000.00000004.00000001.sdmp	Binary or memory string: C:\Users\user\AppData\Local\lkjhgfs.exe4
Source: lkjhgfs.exe, 0000000F.00000002.485971051.0000000000C80000.00000004.00000040.sdmp, lkjhgfs.exe, 00000011.00000002.497543143.0000000000CF0000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\lkjhgfs.exe
Source: RegAsm.exe, 0000000C.00000003.486917084.0000000005B46000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exe0
Source: 20014464370.PDF.exe, 00000001.00000002.345363634.00000000058A0000.00000002.00000001.sdmp, lkjhgfs.exe, 0000000F.00000002.492655545.00000000050F0000.00000002.00000001.sdmp, lkjhgfs.exe, 00000011.00000002.505221998.0000000004F40000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: lkjhgfs.exe, 0000000F.00000002.486391031.0000000000E69000.00000004.00000020.sdmp	Binary or memory string: C:\Windows\Temp\AslLog_DetectorsTrace_lkjhgfs.exe_1848.txt
Source: lkjhgfs.exe, 00000011.00000002.497816109.0000000000D24000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\lkjhgfs.exedlsk
Source: lkjhgfs.exe, 0000000F.00000002.486371354.0000000000E60000.00000004.00000020.sdmp, lkjhgfs.exe, 00000011.00000002.497543143.0000000000CF0000.00000004.00000020.sdmp	Binary or memory string: "C:\Users\user\AppData\Local\lkjhgfs.exe"
Source: 20014464370.PDF.exe, 00000001.00000002.341926075.00000000031D0000.00000004.00000001.sdmp	Binary or memory string: l)C:\Users\user\AppData\Local\lkjhgfs.exe
Source: RegAsm.exe, 0000000C.00000003.402073587.00000000062F3000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exe@"
Source: lkjhgfs.exe, 0000000F.00000002.486775398.0000000002BB1000.00000004.00000001.sdmp, lkjhgfs.exe, 00000011.00000002.498841834.0000000002951000.00000004.00000001.sdmp	Binary or memory string: l)C:\Users\user\AppData\Local\lkjhgfs.exe@p^
Source: lkjhgfs.exe, 00000011.00000002.497605970.0000000000CFA000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\lkjhgfs.exeILE=xk
Source: lkjhgfs.exe, 00000011.00000002.498096071.0000000000D58000.00000004.00000001.sdmp	Binary or memory string: C:\Users\user\AppData\Local\lkjhgfs.
Source: lkjhgfs.exe, 0000000F.00000002.486837759.0000000002C00000.00000004.00000001.sdmp, lkjhgfs.exe, 00000011.00000002.499016642.00000000029A0000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exeH
Source: lkjhgfs.exe, 0000000F.00000002.486434084.0000000000E9E000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\lkjhgfs.exea
Source: lkjhgfs.exe, 00000011.00000002.498841834.0000000002951000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: lkjhgfs.exe, 0000000F.00000002.486434084.0000000000E9E000.00000004.00000020.sdmp	Binary or memory string: file:///C:/Users/user/AppData/Local/lkjhgfs.exe
Source: RegAsm.exe, 0000000C.00000003.427371081.00000000062F3000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exe@
Source: lkjhgfs.exe, 00000011.00000002.497605970.0000000000CFA000.00000004.00000020.sdmp	Binary or memory string: <add name="workflowRuntime" type="System.ServiceModel.Configuration.WorkflowRuntimeElement, System.WorkflC:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lkjhgfs.exe.log/>
Source: lkjhgfs.exe, 0000000F.00000002.486448464.0000000000EB0000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\lkjhgfs.exe.configd
Source: lkjhgfs.exe, 00000011.00000002.498841834.0000000002951000.00000004.00000001.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: RegAsm.exe, 0000000C.00000003.451762132.00000000062F6000.00000004.00000001.sdmp	Binary or memory string: }\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: lkjhgfs.exe, 00000011.00000002.497309382.0000000000BB0000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\C:\Users\user\AppData\Local\lkjhgfs.exe"C:\Users\user\AppData\Local\lkjhgfs.exe" C:\Users\user\AppData\Local\lkjhgfs.exeWinsta0\Default
Source: RegAsm.exe, 0000000C.00000003.482575979.000000000630E000.00000004.00000001.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:-
Source: lkjhgfs.exe, 0000000F.00000002.486775398.0000000002BB1000.00000004.00000001.sdmp, lkjhgfs.exe, 00000011.00000002.498841834.0000000002951000.00000004.00000001.sdmp	Binary or memory string: l0C:\Users\user\AppData\Local\lkjhgfs.exe.config<
Source: 20014464370.PDF.exe, 00000001.00000002.341926075.00000000031D0000.00000004.00000001.sdmp	Binary or memory string: l+"C:\Users\user\AppData\Local\lkjhgfs.exe"
Source: lkjhgfs.exe, 0000000F.00000002.486391031.0000000000E69000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\lkjhgfs.exeNET
Source: lkjhgfs.exe, 00000011.00000002.497816109.0000000000D24000.00000004.00000020.sdmp	Binary or memory string: sers\user\AppData\Local\lkjhgfs.exe.config
Source: RegAsm.exe, 0000000C.00000002.504987009.000000000453F000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exe #
Source: lkjhgfs.exe, 0000000F.00000002.486391031.0000000000E69000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\lkjhgfs.exeZ
Source: RegAsm.exe, 0000000C.00000003.469264007.0000000005B1B000.00000004.00000001.sdmp, lkjhgfs.exe, 0000000F.00000002.492975324.0000000005540000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exeP
Source: lkjhgfs.exe, 0000000F.00000002.486391031.0000000000E69000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\lkjhgfs.exeX
Source: 20014464370.PDF.exe, 00000001.00000002.345363634.00000000058A0000.00000002.00000001.sdmp, lkjhgfs.exe, 0000000F.00000002.492655545.00000000050F0000.00000002.00000001.sdmp, lkjhgfs.exe, 00000011.00000002.505221998.0000000004F40000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: RegAsm.exe, 0000000C.00000003.369719228.0000000005B01000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exed
Source: lkjhgfs.exe, 00000011.00000002.497816109.0000000000D24000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\lkjhgfs.exe.config{j
Source: RegAsm.exe, 0000000C.00000003.451716416.000000000629A000.00000004.00000001.sdmp, lkjhgfs.exe, 0000000F.00000003.483683958.0000000000EF7000.00000004.00000001.sdmp, lkjhgfs.exe, 00000011.00000002.494838264.0000000000975000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exeh
Source: 20014464370.PDF.exe, 00000001.00000002.345363634.00000000058A0000.00000002.00000001.sdmp, lkjhgfs.exe, 0000000F.00000002.492655545.00000000050F0000.00000002.00000001.sdmp, lkjhgfs.exe, 00000011.00000002.505221998.0000000004F40000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: lkjhgfs.exe, 0000000F.00000002.486448464.0000000000EB0000.00000004.00000020.sdmp	Binary or memory string: sers\user\AppData\Local\lkjhgfs.exe.config-msO
Source: RegAsm.exe, 0000000C.00000002.504987009.000000000453F000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exe\
Source: RegAsm.exe, 0000000C.00000003.411710139.00000000062ED000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exe`
Source: lkjhgfs.exe, 00000011.00000002.497816109.0000000000D24000.00000004.00000020.sdmp	Binary or memory string: file:///C:/Users/user/AppData/Local/lkjhgfs.exevk
Source: lkjhgfs.exe, 0000000F.00000002.486448464.0000000000EB0000.00000004.00000020.sdmp	Binary or memory string: lkjhgfs.exeb
Source: lkjhgfs.exe, 00000011.00000002.497543143.0000000000CF0000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\C:\Users\user\AppData\Local\lkjhgfs.exe"C:\Users\user\AppData\Local\lkjhgfs.exe" C:\Users\user\AppData\Local\lkjhgfs.exeWinsta0\Default=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=computerComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=5507ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=computerUSERDOMAIN_ROAMINGPROFILE=computerUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowssk
Source: lkjhgfs.exe, 0000000F.00000002.486391031.0000000000E69000.00000004.00000020.sdmp	Binary or memory string: crosoft\CLR_v4.0_32\UsageLogs\lkjhgfs.exe.log
Source: lkjhgfs.exe, 0000000F.00000002.486837759.0000000002C00000.00000004.00000001.sdmp, lkjhgfs.exe, 00000011.00000002.499016642.00000000029A0000.00000004.00000001.sdmp	Binary or memory string: l)c:\users\user\appdata\local\lkjhgfs.exe
Source: lkjhgfs.exe, 0000000F.00000002.486371354.0000000000E60000.00000004.00000020.sdmp	Binary or memory string: C:\Windows\Temp\AslLog_shimengstate_lkjhgfs.exe_1848.txt(V
Source: lkjhgfs.exe, 0000000F.00000002.486448464.0000000000EB0000.00000004.00000020.sdmp	Binary or memory string: file:///C:/Users/user/AppData/Local/lkjhgfs.exe9
Source: lkjhgfs.exe, 0000000F.00000002.486391031.0000000000E69000.00000004.00000020.sdmp	Binary or memory string: <SHIMENGSTATE PID="1848" FILENAME="C:\Users\user\AppData\Local\lkjhgfs.exe" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:schemas.microsoft.com/appcompat/2010/03/shimengstate EngineState.xsd" xmlns="urn:schemas.microsoft.com/appcompat/2010/03/shimengstate">
Source: lkjhgfs.exe, 0000000F.00000002.485861642.00000000009E5000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exex
Source: lkjhgfs.exe, 0000000F.00000002.486371354.0000000000E60000.00000004.00000020.sdmp, lkjhgfs.exe, 00000011.00000002.497543143.0000000000CF0000.00000004.00000020.sdmp	Binary or memory string: sers\user\AppData\Local\lkjhgfs.exeDATA=C:\Users\user\AppData\RoamingCommonP
Source: lkjhgfs.exe, 0000000F.00000002.486448464.0000000000EB0000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\lkjhgfs.exeo
Source: lkjhgfs.exe, 0000000F.00000002.486391031.0000000000E69000.00000004.00000020.sdmp	Binary or memory string: lkjhgfs.exen
Source: lkjhgfs.exe, 00000011.00000002.498096071.0000000000D58000.00000004.00000001.sdmp	Binary or memory string: C:\Windows\Temp\AslLog_ApphelpDebug_lkjhgfs.exe_5188.txt
Source: RegAsm.exe, 0000000C.00000002.504987009.000000000453F000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exep
Source: 20014464370.PDF.exe, 00000001.00000002.341859487.0000000003161000.00000004.00000001.sdmp, RegAsm.exe, 0000000C.00000003.451716416.000000000629A000.00000004.00000001.sdmp, lkjhgfs.exe, 0000000F.00000002.486448464.0000000000EB0000.00000004.00000020.sdmp, lkjhgfs.exe, 00000011.00000002.499016642.00000000029A0000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exe
Source: lkjhgfs.exe, 00000011.00000002.494838264.0000000000975000.00000004.00000001.sdmp	Binary or memory string: C:\Users\user\AppData\Local\lkjhgfs.exe!
Source: 20014464370.PDF.exe, 00000001.00000002.341859487.0000000003161000.00000004.00000001.sdmp, lkjhgfs.exe, 0000000F.00000002.486775398.0000000002BB1000.00000004.00000001.sdmp, lkjhgfs.exe, 00000011.00000002.498841834.0000000002951000.00000004.00000001.sdmp	Binary or memory string: l)C:\Users\user\AppData\Local\lkjhgfs.exe8^
Source: 20014464370.PDF.exe, 00000001.00000002.341926075.00000000031D0000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs
Source: RegAsm.exe, 0000000C.00000002.504987009.000000000453F000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exep
Source: lkjhgfs.exe, 0000000F.00000002.486448464.0000000000EB0000.00000004.00000020.sdmp	Binary or memory string: SION_APPCFG_DOWNLOAD_ATTEMPTED__/lkjhgfs.exe.configT
Source: lkjhgfs.exe, 00000011.00000002.497816109.0000000000D24000.00000004.00000020.sdmp	Binary or memory string: a\Local\lkjhgfs.exe
Source: RegAsm.exe, 0000000C.00000002.504987009.000000000453F000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exep#
Source: lkjhgfs.exe, 00000011.00000002.497543143.0000000000CF0000.00000004.00000020.sdmp	Binary or memory string: "C:\Users\user\AppData\Local\lkjhgfs.exe" \|k
Source: lkjhgfs.exe, 0000000F.00000002.493092915.000000000577F000.00000004.00000001.sdmp, lkjhgfs.exe, 00000011.00000002.505527243.00000000054FF000.00000004.00000001.sdmp	Binary or memory string: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lkjhgfs.exe.log
Source: lkjhgfs.exe, 0000000F.00000002.486371354.0000000000E60000.00000004.00000020.sdmp	Binary or memory string: "C:\Users\user\AppData\Local\lkjhgfs.exe" G
Source: lkjhgfs.exe, 0000000F.00000002.486448464.0000000000EB0000.00000004.00000020.sdmp	Binary or memory string: \??\C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lkjhgfs.exe.log
Source: lkjhgfs.exe, 0000000F.00000002.486391031.0000000000E69000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\lkjhgfs.exewiB
Source: lkjhgfs.exe, 0000000F.00000002.486448464.0000000000EB0000.00000004.00000020.sdmp	Binary or memory string: \??\C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lkjhgfs.exe.logB
Source: 20014464370.PDF.exe, 00000001.00000002.345363634.00000000058A0000.00000002.00000001.sdmp, lkjhgfs.exe, 0000000F.00000002.492655545.00000000050F0000.00000002.00000001.sdmp, lkjhgfs.exe, 00000011.00000002.505221998.0000000004F40000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: lkjhgfs.exe, 0000000F.00000002.485986107.0000000000CB0000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\C:\Users\user\AppData\Local\lkjhgfs.exe"C:\Users\user\AppData\Local\lkjhgfs.exe" C:\Users\user\AppData\Local\lkjhgfs.exeWinsta0\Defaulthk
Source: RegAsm.exe, 0000000C.00000003.419831061.0000000005B1B000.00000004.00000001.sdmp	Binary or memory string: lkjhgfs.exel)
Source: lkjhgfs.exe, 00000011.00000002.497605970.0000000000CFA000.00000004.00000020.sdmp	Binary or memory string: C:\Windows\Microsoft.NET\Framework\v4.0.30319;C:\WindoC:\Users\user\AppData\Local\lkjhgfs.exe;C:\ck

Source: C:\Users\user\Desktop\20014464370.PDF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\20014464370.PDF.exe

Code function: 1_2_015F2B20 LdrInitializeThunk,

1_2_015F2B20

Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\20014464370.PDF.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\20014464370.PDF.exe	Memory allocated: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Memory allocated: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\20014464370.PDF.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\20014464370.PDF.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 420000	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\20014464370.PDF.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 69A008	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 420000	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 422000	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Memory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: CCE008	Jump to behavior

Source: C:\Users\user\Desktop\20014464370.PDF.exe	Process created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exe gyujnbgh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe 'C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Process created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exe gyujnbgh	Jump to behavior

Source: RegAsm.exe, 0000000C.00000002.501411238.0000000002BB6000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 0000000C.00000002.497785032.0000000000FC0000.00000002.00000001.sdmp, AAAstarupxxzzzgb.exe, 00000016.00000002.497120798.0000000000E40000.00000002.00000001.sdmp, RegAsm.exe, 00000017.00000002.498270397.00000000015E0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 0000000C.00000002.497785032.0000000000FC0000.00000002.00000001.sdmp, AAAstarupxxzzzgb.exe, 00000016.00000002.497120798.0000000000E40000.00000002.00000001.sdmp, RegAsm.exe, 00000017.00000002.498270397.00000000015E0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: RegAsm.exe, 0000000C.00000002.497785032.0000000000FC0000.00000002.00000001.sdmp, AAAstarupxxzzzgb.exe, 00000016.00000002.497120798.0000000000E40000.00000002.00000001.sdmp, RegAsm.exe, 00000017.00000002.498270397.00000000015E0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: RegAsm.exe, 0000000C.00000002.508952160.000000000651E000.00000004.00000001.sdmp	Binary or memory string: Program Manager0
Source: RegAsm.exe, 0000000C.00000002.502793642.0000000002CF8000.00000004.00000001.sdmp	Binary or memory string: Program ManagerT?
Source: RegAsm.exe, 0000000C.00000002.497785032.0000000000FC0000.00000002.00000001.sdmp, AAAstarupxxzzzgb.exe, 00000016.00000002.497120798.0000000000E40000.00000002.00000001.sdmp, RegAsm.exe, 00000017.00000002.498270397.00000000015E0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: RegAsm.exe, 0000000C.00000002.497785032.0000000000FC0000.00000002.00000001.sdmp, AAAstarupxxzzzgb.exe, 00000016.00000002.497120798.0000000000E40000.00000002.00000001.sdmp, RegAsm.exe, 00000017.00000002.498270397.00000000015E0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: RegAsm.exe, 0000000C.00000002.508533453.00000000059BB000.00000004.00000001.sdmp	Binary or memory string: lProgram Manager

Source: C:\Users\user\Desktop\20014464370.PDF.exe	Queries volume information: C:\Users\user\Desktop\20014464370.PDF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Queries volume information: C:\Users\user\AppData\Local\lkjhgfs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\lkjhgfs.exe	Queries volume information: C:\Users\user\AppData\Local\lkjhgfs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\20014464370.PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000017.00000000.484413891.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.498671862.0000000002DA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.508139093.0000000004F80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.489565052.0000000003E8E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.504178420.0000000003C2E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.340662970.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.339849220.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.493387609.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.504714336.000000000432F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.498968741.0000000003DA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.504008398.0000000003B8F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.342734107.00000000042DD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.503817122.0000000003FFE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.485173449.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.503247081.0000000003731000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.487979449.0000000003D0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.493405932.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.504360558.00000000041CE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.488625589.0000000003DEF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.503763443.0000000003AAE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.342922605.000000000437C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5612, type: MEMORY
Source: Yara match	File source: Process Memory Space: 20014464370.PDF.exe PID: 5480, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 964, type: MEMORY
Source: Yara match	File source: Process Memory Space: lkjhgfs.exe PID: 5188, type: MEMORY
Source: Yara match	File source: Process Memory Space: lkjhgfs.exe PID: 1848, type: MEMORY
Source: Yara match	File source: 12.2.RegAsm.exe.4f80000.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41d3b98.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.432ca68.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.437ca88.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4334738.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bb66a8.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3deff64.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3deb12e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3c2e6e8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.437ca88.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e8e6e8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3c2e6e8.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.4304a48.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41d81c1.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.377ff64.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3deff64.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4f84629.23.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4f80000.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3aae278.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e8e6e8.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e3e6c8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bb66a8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41ced62.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.378458d.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3df458d.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4338d61.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e166a8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.432ca68.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e166a8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e3e6c8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.377b12e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.41fc618.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.377ff64.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41d3b98.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.40b9625.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.432f902.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bde6c8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bde6c8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.40ad3f1.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.40cdc52.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4334738.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3d0e278.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.4304a48.6.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: 20014464370.PDF.exe, 00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: RegAsm.exe, 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
Source: RegAsm.exe, 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
Source: RegAsm.exe, 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
Source: RegAsm.exe, 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
Source: lkjhgfs.exe, 0000000F.00000002.486837759.0000000002C00000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: lkjhgfs.exe, 00000011.00000002.499016642.00000000029A0000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 00000017.00000002.498671862.0000000002DA1000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 00000017.00000002.498671862.0000000002DA1000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000017.00000000.484413891.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.498671862.0000000002DA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.508139093.0000000004F80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.489565052.0000000003E8E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.504178420.0000000003C2E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.340662970.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.339849220.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.493387609.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.504714336.000000000432F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.498968741.0000000003DA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.504008398.0000000003B8F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.342734107.00000000042DD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.503817122.0000000003FFE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.485173449.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.503247081.0000000003731000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.487979449.0000000003D0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.493405932.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.504360558.00000000041CE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.488625589.0000000003DEF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.503763443.0000000003AAE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.342922605.000000000437C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5612, type: MEMORY
Source: Yara match	File source: Process Memory Space: 20014464370.PDF.exe PID: 5480, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 964, type: MEMORY
Source: Yara match	File source: Process Memory Space: lkjhgfs.exe PID: 5188, type: MEMORY
Source: Yara match	File source: Process Memory Space: lkjhgfs.exe PID: 1848, type: MEMORY
Source: Yara match	File source: 12.2.RegAsm.exe.4f80000.22.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41d3b98.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.432ca68.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.437ca88.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4334738.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bb66a8.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3deff64.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3deb12e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3c2e6e8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.437ca88.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e8e6e8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3c2e6e8.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.4304a48.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41d81c1.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.377ff64.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3deff64.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4f84629.23.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4f80000.22.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3aae278.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e8e6e8.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e3e6c8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bb66a8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41ced62.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.378458d.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.RegAsm.exe.3df458d.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4338d61.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e166a8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.432ca68.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e166a8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3e3e6c8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.377b12e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.41fc618.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.377ff64.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.41d3b98.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.40b9625.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.RegAsm.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.432f902.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bde6c8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.lkjhgfs.exe.3bde6c8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.40ad3f1.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.40cdc52.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.4334738.19.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.lkjhgfs.exe.3d0e278.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.20014464370.PDF.exe.4304a48.6.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	Registry Run Keys / Startup Folder1	Process Injection312	Masquerading11	Input Capture21	Query Registry1	Remote Services	Input Capture21	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	DLL Side-Loading1	Registry Run Keys / Startup Folder1	Disable or Modify Tools1	LSASS Memory	Security Software Discovery221	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	DLL Side-Loading1	Virtualization/Sandbox Evasion31	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection312	NTDS	Virtualization/Sandbox Evasion31	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information13	Cached Domain Credentials	File and Directory Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing13	DCSync	System Information Discovery12	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Timestomp1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	DLL Side-Loading1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
20014464370.PDF.exe	29%	Virustotal		Browse
20014464370.PDF.exe	15%	ReversingLabs	ByteCode-MSIL.Downloader.Seraph

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\RegAsm.exe	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\RegAsm.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\RegAsm.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\lkjhgfs.exe	15%	ReversingLabs	ByteCode-MSIL.Downloader.Seraph

Unpacked PE Files

Source	Detection	Scanner	Label	Download
12.2.RegAsm.exe.4f80000.22.unpack	100%	Avira	TR/NanoCore.fadte	Download File
23.0.RegAsm.exe.400000.1.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
23.2.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
23.0.RegAsm.exe.400000.3.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.RegAsm.exe.400000.1.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.2.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.RegAsm.exe.400000.3.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
startedhere.ddns.net	9%	Virustotal		Browse
startedhere.ddns.net	0%	Avira URL Cloud	safe
23.105.131.142	5%	Virustotal		Browse
23.105.131.142	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
startedhere.ddns.net	true	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
23.105.131.142	true	5%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://us1.unwiredlabs.com/v2/process.php	lkjhgfs.exe, AAAstarupxxzzzgb.exe, 20014464370.PDF.exe	false		high
http://us1.unwiredlabs.com/v2/process.php?application/json;	RegAsm.exe, 0000000C.00000002.509338103.0000000006C1C000.00000004.00000001.sdmp, AAAstarupxxzzzgb.exe.12.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.105.131.142	unknown	United States		396362	LEASEWEB-USA-NYC-11US	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	432418
Start date:	10.06.2021
Start time:	10:16:15
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	20014464370.PDF.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@9/10@0/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.3% (good quality ratio 0.2%) Quality average: 62.6% Quality standard deviation: 26.5%
HCA Information:	Successful, ratio: 91% Number of executed functions: 279 Number of non-executed functions: 13
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:17:58	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run lkjhgfs "C:\Users\user\AppData\Local\lkjhgfs.exe"
10:18:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run lkjhgfs "C:\Users\user\AppData\Local\lkjhgfs.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
23.105.131.142	DHL#DOCUMENTS001010.PDF.exe	Get hash	malicious	Browse
	RFQ27559404D4E5A.PDF.exe	Get hash	malicious	Browse
	RFQ#21040590409448.pdf.exe	Get hash	malicious	Browse
	DHL#DOCUMENTS02010910.PDF.exe	Get hash	malicious	Browse
	QOUTATION#2300003590.PDF.exe	Get hash	malicious	Browse
	ORDER#INQUIRY000111.PDF.exe	Get hash	malicious	Browse
	RFQ#QQO2103060.PDF.exe	Get hash	malicious	Browse
	RFQ#QQO2103060.PDF.exe	Get hash	malicious	Browse
	AWBSHIPMENT20210000900.PDF.exe	Get hash	malicious	Browse
	Order#PPO040963RG02.PDF.exe	Get hash	malicious	Browse
	iOI0kJwm97.exe	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
LEASEWEB-USA-NYC-11US	DHL#DOCUMENTS001010.PDF.exe	Get hash	malicious	Browse	23.105.131.142
	2lt24JqVH4.exe	Get hash	malicious	Browse	23.105.131.207
	RFQ27559404D4E5A.PDF.exe	Get hash	malicious	Browse	23.105.131.142
	XVIdVNjoHl.exe	Get hash	malicious	Browse	23.105.131.173
	cKWxEAbeX7.exe	Get hash	malicious	Browse	23.105.131.251
	apWkH5Vq75.exe	Get hash	malicious	Browse	23.105.131.141
	RFQ#21040590409448.pdf.exe	Get hash	malicious	Browse	23.105.131.142
	Urgent Contract Order GH7856648,pdf.exe	Get hash	malicious	Browse	23.105.131.132
	DHL#DOCUMENTS02010910.PDF.exe	Get hash	malicious	Browse	23.105.131.142
	QOUTATION#2300003590.PDF.exe	Get hash	malicious	Browse	23.105.131.142
	Purchase Order.exe	Get hash	malicious	Browse	23.105.131.158
	Scanned Documents.exe	Get hash	malicious	Browse	23.105.131.158
	ORDER#INQUIRY000111.PDF.exe	Get hash	malicious	Browse	23.105.131.142
	URGENT ORDER 2T6U545267,pdf.exe	Get hash	malicious	Browse	23.105.131.132
	9849858 PO.exe	Get hash	malicious	Browse	23.105.131.166
	Yeni sipari_ WJO-001, pdf.exe	Get hash	malicious	Browse	23.105.131.132
	061195d6_by_Libranalysis.exe	Get hash	malicious	Browse	23.105.131.158
	URGENT ORDER 2T6U545267,pdf.exe	Get hash	malicious	Browse	23.105.131.132
	ORDER QUOTE CBM787563788265542,pdf.exe	Get hash	malicious	Browse	23.105.131.132
	PO ____-34002174,pdf.exe	Get hash	malicious	Browse	23.105.131.141

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\RegAsm.exe	aXgdOUvL9L.exe	Get hash	malicious	Browse
	DHL#DOCUMENTS001010.PDF.exe	Get hash	malicious	Browse
	kyIfnzzg3E.exe	Get hash	malicious	Browse
	flyZab7hHk.exe	Get hash	malicious	Browse
	AedJpyQ9lM.exe	Get hash	malicious	Browse
	UPDATED SOA.exe	Get hash	malicious	Browse
	qdFDmi3Bhy.exe	Get hash	malicious	Browse
	RFQ27559404D4E5A.PDF.exe	Get hash	malicious	Browse
	Receiptn.exe	Get hash	malicious	Browse
	PURCHASE LIST.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.PackedNET.783.10804.exe	Get hash	malicious	Browse
	Y6k2VgaGck.exe	Get hash	malicious	Browse
	Bank swift.exe	Get hash	malicious	Browse
	tT1XWdxOYv.exe	Get hash	malicious	Browse
	363IN050790620 BOOKING.exe	Get hash	malicious	Browse
	New Order.exe	Get hash	malicious	Browse
	RFQ#21040590409448.pdf.exe	Get hash	malicious	Browse
	DHL#DOCUMENTS02010910.PDF.exe	Get hash	malicious	Browse
	QOUTATION#2300003590.PDF.exe	Get hash	malicious	Browse
	1p037oXV3S.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\20014464370.PDF.exe.log Download File
Process:	C:\Users\user\Desktop\20014464370.PDF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.340009400190196
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:ML9E4Ks2wKDE4KhK3VZ9pKhk
MD5:	CC144808DBAF00E03294347EADC8E779
SHA1:	A3434FC71BA82B7512C813840427C687ADDB5AEA
SHA-256:	3FC7B9771439E777A8F8B8579DD499F3EB90859AD30EFD8A765F341403FC7101
SHA-512:	A4F9EB98200BCAF388F89AABAF7EA57661473687265597B13192C24F06638C6339A3BD581DF4E002F26EE1BA09410F6A2BBDB4DA0CD40B59D63A09BAA1AADD3D
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lkjhgfs.exe.log Download File
Process:	C:\Users\user\AppData\Local\lkjhgfs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.340009400190196
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:ML9E4Ks2wKDE4KhK3VZ9pKhk
MD5:	CC144808DBAF00E03294347EADC8E779
SHA1:	A3434FC71BA82B7512C813840427C687ADDB5AEA
SHA-256:	3FC7B9771439E777A8F8B8579DD499F3EB90859AD30EFD8A765F341403FC7101
SHA-512:	A4F9EB98200BCAF388F89AABAF7EA57661473687265597B13192C24F06638C6339A3BD581DF4E002F26EE1BA09410F6A2BBDB4DA0CD40B59D63A09BAA1AADD3D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	555384
Entropy (8bit):	7.863587847620472
Encrypted:	false
SSDEEP:	12288:hnn0UORILclLBvmhcdL/4tWKG1Gu7iTQezjBwEHZ2TG:t0TILcUcN/4tc1Gu7KzuEHZ2y
MD5:	C7330A70647D84A218BBE2E6D245DCE3
SHA1:	91BB54E5B469BE1429216537721CBAF88FCBFD29
SHA-256:	437A44B0CBC1CDEA568E82DFBDB6A08B34C4C478FEF392F53C9D3E86BC785B44
SHA-512:	AA741C300346B004535629F3901366F6C65E4A05AC43BC915306FC6A6793FF68CC1F458074D95B5B10BCFE04E37D9BFBB8ABBABEC710EAFD8A3AD1E93034A6E5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe, Author: Joe Security
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....cQ...............0............I... ........@.. ....................................@..................................H..O....`...'...........V..x#...........H............................................... ............... ..H............text...4)... ..................... ..`.rsrc....'...`...(...,..............@..@.reloc...............T..............@..B.................I......H.......\,..d..............p............................................(......(....(...........s....o......}.....0..F.......(....r...po.....s.......o....(.....o....o........,..o......,..o.................0..........:.......~.............0..'..........+. ....(......Y..-.s....o.....{......{...."..}......{...."..}....>..(......(......{...."..}......{...."..}....>..(......(....*..0..b........s......s.....r9..p.o.........(....(....r]..p.o.........(....(.....(....

C:\Users\user\AppData\Local\Temp\RegAsm.exe Download File
Process:	C:\Users\user\Desktop\20014464370.PDF.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64616
Entropy (8bit):	6.037264560032456
Encrypted:	false
SSDEEP:	768:J8XcJiMjm2ieHlPyCsSuJbn8dBhFVBSMQ6Iq8TSYDKpgLaDViRLNdr:9YMaNylPYSAb8dBnTHv8DKKaDVkX
MD5:	6FD7592411112729BF6B1F2F6C34899F
SHA1:	5E5C839726D6A43C478AB0B95DBF52136679F5EA
SHA-256:	FFE4480CCC81B061F725C54587E9D1BA96547D27FE28083305D75796F2EB3E74
SHA-512:	21EFCC9DEE3960F1A64C6D8A44871742558666BB792D77ACE91236C7DBF42A6CA77086918F363C4391D9C00904C55A952E2C18BE5FA1A67A509827BFC630070D
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: aXgdOUvL9L.exe, Detection: malicious, Browse Filename: DHL#DOCUMENTS001010.PDF.exe, Detection: malicious, Browse Filename: kyIfnzzg3E.exe, Detection: malicious, Browse Filename: flyZab7hHk.exe, Detection: malicious, Browse Filename: AedJpyQ9lM.exe, Detection: malicious, Browse Filename: UPDATED SOA.exe, Detection: malicious, Browse Filename: qdFDmi3Bhy.exe, Detection: malicious, Browse Filename: RFQ27559404D4E5A.PDF.exe, Detection: malicious, Browse Filename: Receiptn.exe, Detection: malicious, Browse Filename: PURCHASE LIST.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PackedNET.783.10804.exe, Detection: malicious, Browse Filename: Y6k2VgaGck.exe, Detection: malicious, Browse Filename: Bank swift.exe, Detection: malicious, Browse Filename: tT1XWdxOYv.exe, Detection: malicious, Browse Filename: 363IN050790620 BOOKING.exe, Detection: malicious, Browse Filename: New Order.exe, Detection: malicious, Browse Filename: RFQ#21040590409448.pdf.exe, Detection: malicious, Browse Filename: DHL#DOCUMENTS02010910.PDF.exe, Detection: malicious, Browse Filename: QOUTATION#2300003590.PDF.exe, Detection: malicious, Browse Filename: 1p037oXV3S.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...xX.Z..............0.............^.... ........@.. ....................... ............`.....................................O.......8...............h>........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B................@.......H........A...p..........T................................................~P...-.r...p.....(....(....s.....P.....0.."........(......-.r...p.rI..p(....s....z....0..........(....~P.....o........(....n(.....(..........%...(....~(.....(..........%...%...(.....(.....(..........%...%...%...(....V.(......}Q.....}R.....{Q.....{R......0...........(.......i.=...}S......i.@...}T......i.@...}U.....+m...(....o .....r]..p.o!...,..{T.......{U........o"....+(.ra..p.o!...,..{T.......

C:\Users\user\AppData\Local\lkjhgfs.exe Download File
Process:	C:\Users\user\Desktop\20014464370.PDF.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	675888
Entropy (8bit):	7.810992682624759
Encrypted:	false
SSDEEP:	12288:Xd4tWKG1Gu7iTQezjBwIw77rMNksUCT/jVOf/kx9gjEe8F3G:Xd4tc1Gu7KzuIw77fCT/jVssrgjXMG
MD5:	CAC542CD84BE91EA0ACFB9CD1964397D
SHA1:	339D543A12E1F849BFE14A71C4A05106380548AB
SHA-256:	49C28C9AB46C71450929FFC850DC411CF24F125659CC253F0EE5FB16A59E3F7F
SHA-512:	4EF0EAC7564794439EB4642DFF1A5861D44382918C7B334EAF99B791B0F848E428E9609E2C1A3DC965E7E66FD64A72590C6D3AA3CE1C1FF36188E4F083E8231F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: C:\Users\user\AppData\Local\lkjhgfs.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 15%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G.`.................D..........~b... ........@.. ....................................@.................................0b..K.................... ..00...`....................................................... ............... ..H............text....B... ...D.................. ..`.rsrc................F..............@..@.reloc.......`......................@..B................`b......H........A..x/..........<q...............................................0..N.......8=...8C...8....(....8....8....8....(....8....8....8.....:....8.....:....8.........&~..........~......0..........8U.......E........8....~....r...pr...po....8....~....rS..prs..po....8....s.....:....&8E...s.....:O...&8....8/...89...s.....:C...&8....~....r...pr...po....8....s.........8....*8.........8....8......... ....~}...:2...&8(...8g........8.....0..H..........9....8....&:....8....8....&8.

C:\Users\user\AppData\Local\lkjhgfs.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\20014464370.PDF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat Download File
Process:	C:\Users\user\AppData\Local\Temp\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	7.024371743172393
Encrypted:	false
SSDEEP:	6:X4LDAnybgCFcpJSQwP4d7ZrqJgTFwoaw+9XU4:X4LEnybgCFCtvd7ZrCgpwoaw+Z9
MD5:	32D0AAE13696FF7F8AF33B2D22451028
SHA1:	EF80C4E0DB2AE8EF288027C9D3518E6950B583A4
SHA-256:	5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
SHA-512:	1D77FC13512C0DBC4EFD7A66ACB502481E4EFA0FB73D0C7D0942448A72B9B05BA1EA78DDF0BE966363C2E3122E0B631DB7630D044D08C1E1D32B9FB025C356A5
Malicious:	false
Preview:	Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Users\user\AppData\Local\Temp\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.75
Encrypted:	false
SSDEEP:	3:Gktn:P
MD5:	1D19602EA24916F09701CCCB05905182
SHA1:	3D5926272B97E33D9F7F0FF44FB09DEEF7209B55
SHA-256:	7BEB1EE881354A985031267FBC99B9D238AF7A2C40ACEAD51B5608880A18646C
SHA-512:	39D29AF3B6FF772E6CB9A7D9354B93F4CED2E65A6BD2F2BC1A5CE7567C869A2773A0D1750A65DD72227DDA642831C62FFD6719EE34EF7787E2114581E2B8AC46
Malicious:	true
Preview:	..H.3,.H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bin Download File
Process:	C:\Users\user\AppData\Local\Temp\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	5.153055907333276
Encrypted:	false
SSDEEP:	3:9bzY6oRDT6P2bfVn1:RzWDT621
MD5:	4E5E92E2369688041CC82EF9650EDED2
SHA1:	15E44F2F3194EE232B44E9684163B6F66472C862
SHA-256:	F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
SHA-512:	1B368018907A3BC30421FDA2C935B39DC9073B9B1248881E70AD48EDB6CAA256070C1A90B97B0F64BBE61E316DBB8D5B2EC8DBABCD0B0B2999AB50B933671ECB
Malicious:	false
Preview:	9iH...}Z.4..f.~a........~.~.......3.U.

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\storage.dat Download File
Process:	C:\Users\user\AppData\Local\Temp\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	327432
Entropy (8bit):	7.99938831605763
Encrypted:	true
SSDEEP:	6144:oX44S90aTiB66x3Pl6nGV4bfD6wXPIZ9iBj0UeprGm2d7Tm:LkjYGsfGUc9iB4UeprKdnm
MD5:	7E8F4A764B981D5B82D1CC49D341E9C6
SHA1:	D9F0685A028FB219E1A6286AEFB7D6FCFC778B85
SHA-256:	0BD3AAC12623520C4E2031C8B96B4A154702F36F97F643158E91E987D317B480
SHA-512:	880E46504FCFB4B15B86B9D8087BA88E6C4950E433616EBB637799F42B081ABF6F07508943ECB1F786B2A89E751F5AE62D750BDCFFDDF535D600CF66EC44E926
Malicious:	false
Preview:	pT..!..W..G.J..a.).@.i..wpK.so@...5.=.^..Q.oy.=e@9.B...F..09u"3.. 0t..RDn_4d.....E...i......~...\|..fX_...Xf.p^......>a..$...e.6:7d.(a.A...=.).....{B.[...y%...i.Q.<..xt.X..H.. ..HF7g...I.3.{.n....L.y;i..s-....(5i...........J.5b7}..fK..HV..,...0.... ....n.w6PMl.......v."".v.......#..X.a....../...cC...i..l{>5n.._+.e.d'...}...[..../...D.t..GVp.zz......(...o......b...+`J.{....hS1G.^I..v&.jm.#u..1..Mg!.E..U.T.....6.2>...6.l.K.w"o..E..."K%{....z.7....<...,....]t.:.....[.Z.u...3X8.QI..j_.&..N..q.e.2...6.R.~..9.Bq..A.v.6.G..#y.....O....Z)G...w..E..k(....+..O..........Vg.2xC......O...jc.....z..~.P...q../.-.'.h.._.cj.=..B.x.Q9.pu.\|i4...i...;O...n.?.,. ....v?.5}.OY@.dG\|<.._[.69@.2..m..I..oP=...xrK.?............b..5....i&...l.c\b}..Q..O+.V.mJ.....pz....>F.......H...6$...d...\|m...N..1.R..B.i..........$....$........CY}..$....r.....H...8...li.....7 P......?h....R.iF..6...q(.@LI.s..+K.....?m..H....*. l..&<}....`\|.B....3.....I..o...u1..8i=.z.W..7

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.810992682624759
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	20014464370.PDF.exe
File size:	675888
MD5:	cac542cd84be91ea0acfb9cd1964397d
SHA1:	339d543a12e1f849bfe14a71c4a05106380548ab
SHA256:	49c28c9ab46c71450929ffc850dc411cf24f125659cc253f0ee5fb16a59e3f7f
SHA512:	4ef0eac7564794439eb4642dff1a5861d44382918c7b334eaf99b791b0f848e428e9609e2c1a3dc965e7e66fd64a72590c6d3aa3ce1c1ff36188e4f083e8231f
SSDEEP:	12288:Xd4tWKG1Gu7iTQezjBwIw77rMNksUCT/jVOf/kx9gjEe8F3G:Xd4tc1Gu7KzuIw77fCT/jVssrgjXMG
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G.`.................D..........~b... ........@.. ....................................@................................

File Icon


Icon Hash:	e0c4a694a4c6e470

Static PE Info

General
Entrypoint:	0x48627e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60C1470F [Wed Jun 9 22:56:15 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign CodeSigning CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	8/25/2020 6:42:07 AM 8/26/2023 6:42:07 AM
Subject Chain	CN=win.rar GmbH, O=win.rar GmbH, L=Berlin, S=Berlin, C=DE
Version:	3
Thumbprint MD5:	185DBD4A2E2671589EEB3E7E1920EA9F
Thumbprint SHA-1:	B3DF816A17A25557316D181DDB9F46254D6D8CA0
Thumbprint SHA-256:	66DB1C86D38273627C837F4638122FA88BBFFFF31C4052115B98CAF6CE0C631E
Serial:	731D40AE3F3A1FB2BC3D8395

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x86230	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x88000	0x1d6b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xa2000	0x3030	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x84284	0x84400	False	0.982798469991	data	7.98698784379	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x88000	0x1d6b8	0x1d800	False	0.311788268008	data	6.0595283491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa6000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x88220	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x88688	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
RT_ICON	0x89730	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0x8bcd8	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_ICON	0x8ff00	0x10828	dBase III DBT, version number 0, next free block index 40
RT_ICON	0xa0728	0x49d5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_GROUP_ICON	0xa5100	0x5a	data
RT_VERSION	0xa515c	0x3a8	data
RT_MANIFEST	0xa5504	0x1b4	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Opera Software 2021
Assembly Version	75.0.3969.171
InternalName	aanjkcxzs.exe
FileVersion	75.0.3969.171
CompanyName	Opera Software
LegalTrademarks
Comments	Opera Installer
ProductName	Opera Installer
ProductVersion	75.0.3969.171
FileDescription	Opera Installer
OriginalFilename	aanjkcxzs.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/10/21-10:18:03.249452	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49730	2092	192.168.2.5	23.105.131.142

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 10, 2021 10:18:02.873836994 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:03.210462093 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:03.210633039 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:03.249452114 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:03.611850023 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:03.620333910 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:03.954127073 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:03.954245090 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:04.335350990 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:04.335542917 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:04.705265045 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:04.746774912 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:04.747026920 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:04.747104883 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:04.747215986 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:04.748337984 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:04.748613119 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:04.748691082 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:04.748976946 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:04.749048948 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:04.749278069 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:04.750730991 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:04.753504992 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:04.759282112 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:04.759372950 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:04.759480953 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.080476999 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.080559015 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.080682039 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.081765890 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.082453966 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.082557917 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.082568884 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.082607985 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.091182947 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.091233969 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.091301918 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.092722893 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.092801094 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.093509912 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.093682051 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.094142914 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.094249964 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.095736980 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.095803022 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.095871925 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.100080967 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.100142956 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.100230932 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.101262093 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.101339102 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.101361036 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.102252007 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.103344917 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.103605032 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.103715897 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.106913090 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.415034056 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.415072918 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.415211916 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.415307999 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.416018009 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.416240931 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.416315079 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.417304039 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.417346001 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.417391062 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.418348074 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.418431997 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.418441057 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.424108982 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.424321890 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.424415112 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.425390005 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.425471067 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.425487041 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.426213026 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.426328897 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.426389933 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.434371948 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.434484005 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.434561014 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.434912920 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.434984922 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.435215950 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.436058998 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.436130047 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.436326981 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.437478065 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.437808990 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.442033052 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.442343950 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.442424059 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.443315983 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.444051981 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.444195986 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.444247961 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.445084095 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.445138931 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.445239067 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.446274042 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.446921110 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.446994066 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.447244883 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.447303057 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.448108912 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.448328018 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.449404955 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.450469971 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.450851917 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.451412916 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.451445103 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.451569080 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.451612949 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.451854944 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.452208996 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.452269077 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.760992050 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.761023998 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.761092901 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.761552095 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.762048960 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.762295961 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.762352943 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.763505936 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.763700962 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.763768911 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.764648914 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.764700890 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.765026093 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.765216112 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.765604973 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.766480923 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.778546095 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.778666973 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.778801918 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.779602051 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.779689074 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.779728889 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.779898882 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.780009985 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.780065060 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.780141115 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.780189991 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.780260086 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.780380964 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.780595064 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.780657053 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.780668020 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.785523891 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.785640001 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.785696030 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.785729885 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.785758972 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.785947084 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.798224926 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.798279047 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.798295021 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.798382998 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.798435926 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.798513889 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.798676014 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.798702955 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.798815012 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.798852921 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.798909903 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.798991919 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.806349993 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.807373047 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.807480097 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.807601929 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.807657003 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.808706045 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.809217930 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.809357882 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.810167074 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.810682058 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.810764074 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.812151909 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.812927008 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.813008070 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.824467897 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.825155020 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.825225115 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.826376915 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.826486111 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.826555014 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.827702045 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.828551054 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.829278946 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.829335928 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.829364061 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.829410076 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:05.830029964 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:05.970685005 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.114191055 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.114392996 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.115080118 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.115345955 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.116733074 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.117012978 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.117060900 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.125075102 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.125231981 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.125274897 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.125483036 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.125554085 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.125588894 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.125655890 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.125799894 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.144052029 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.144088030 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.144157887 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.144193888 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.144365072 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.144494057 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.144556046 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.144587994 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.144634962 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.144684076 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.144805908 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.144925117 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.144984961 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.145080090 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.145133018 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.145164967 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.145349026 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.145524025 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.146370888 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.146991014 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.147995949 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.153825045 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.154299021 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.154380083 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.154419899 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.155236959 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.155277967 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.155319929 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.156461000 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.156538963 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.156764030 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.157241106 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.157560110 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.158432961 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.158621073 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.159455061 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.159544945 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.159634113 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.159687996 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.160237074 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.160356998 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.161597967 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.173193932 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.174448013 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.174639940 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.174803972 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.175101995 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.175169945 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.191267014 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.192071915 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.192188025 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.193114042 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.193366051 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.193423986 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.194092035 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.194200993 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.194247961 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.195346117 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.195449114 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.195523024 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.316220999 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.361352921 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.460460901 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.460675955 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.460772991 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.461265087 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.461369991 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.461422920 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.473018885 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.473072052 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.473112106 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.473148108 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.473150969 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.473187923 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.477332115 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.477426052 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.477504015 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.492680073 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.493272066 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.493377924 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.494102955 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.494362116 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.494426966 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.495095968 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.495503902 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.495572090 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.495965004 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.496299028 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.496361017 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.497267962 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.497462988 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.497539043 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.498414040 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.498455048 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.498503923 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.499361992 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.500201941 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.500272989 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.500452042 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.501415968 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.501487970 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.501631975 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.502209902 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.502273083 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.503026962 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.503290892 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.503357887 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.512969971 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.513010979 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.513092995 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.513235092 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.513413906 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.513473034 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.513562918 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.515084028 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.515161991 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.515336990 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.527837038 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.527986050 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.528390884 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.528489113 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.528542042 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.528979063 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.529364109 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.529429913 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.530617952 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.534440041 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.534543037 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.535276890 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.535356045 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.535413980 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.536046982 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.536335945 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.536403894 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.537723064 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.537823915 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.537880898 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.538064003 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.538244009 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.538299084 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.539277077 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.540046930 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.540117979 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.540189028 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.541068077 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.541129112 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.541323900 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.545278072 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.545371056 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.551646948 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.551728964 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.551810026 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.551852942 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.673921108 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.698256969 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.699224949 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.699364901 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.818542957 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.818586111 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.818845034 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.819555998 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.819849968 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.819916010 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.820188999 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.821156025 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.821243048 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.821425915 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.822911978 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.823003054 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.831664085 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.832725048 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.832838058 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.833457947 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.834073067 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.834172010 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.834275007 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.835297108 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.835331917 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.835380077 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.836129904 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.836215019 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.836349964 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.837332010 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.837543964 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.838490009 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.838648081 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.838720083 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.839128971 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.839325905 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.839426041 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.840483904 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.841037989 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.841109991 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.841342926 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.850522041 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.850575924 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.850662947 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.850702047 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.850733995 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.850833893 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.851012945 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.851062059 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.851073027 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.851233959 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.851398945 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.851427078 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.851551056 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.851603985 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.851675034 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.851783037 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.851830959 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.851860046 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.852274895 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.852329016 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.852399111 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.852504015 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.852538109 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:06.852557898 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:06.986428976 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:08.548491001 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:08.674099922 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:09.421869040 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:09.806871891 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:10.641282082 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:11.019087076 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:11.219096899 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:11.362412930 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:11.580878019 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:11.691929102 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:11.863203049 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:11.951241970 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:11.952188015 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:12.283962965 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:12.284073114 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:12.616938114 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:12.617605925 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:13.010869026 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:13.010962963 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:13.385931015 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:13.557167053 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:13.674453974 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:14.687736988 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:15.066128016 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:15.066868067 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:15.442053080 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:18.576843023 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:18.674912930 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:19.104372025 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:19.174932003 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:20.644699097 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:21.022351980 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:23.577984095 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:23.628421068 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:26.645351887 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:27.027064085 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:27.189089060 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:27.238187075 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:28.583892107 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:28.629218102 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:32.645379066 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:33.027054071 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:33.596167088 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:33.644948006 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:35.272303104 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:35.317054987 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:38.597927094 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:38.645417929 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:38.646034956 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:39.026257992 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.943433046 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.944051027 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.944235086 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.944334984 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.945025921 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.945125103 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.945296049 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.948476076 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.948607922 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.949145079 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.949340105 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.949409008 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.950086117 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.950978041 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.951260090 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.951369047 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.952475071 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.952545881 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.952583075 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.952615976 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.953248024 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.953320980 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.954050064 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.956115007 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.956202030 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.956260920 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.957314014 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.957340002 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.957397938 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.958240032 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.958309889 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.959022999 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.959233999 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.959986925 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.960067987 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.960582018 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.960668087 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.961337090 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.961482048 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.961551905 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.962300062 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.963066101 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.963149071 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.963351965 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.964138031 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.964241028 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.964340925 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.965080023 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.965214968 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.965300083 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.966301918 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.966321945 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.966408014 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.967675924 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.967828035 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.968190908 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.968298912 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.968986034 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.969271898 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.969379902 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.969559908 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.970199108 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.970299006 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.970489025 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.971379995 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.971400976 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.971589088 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.972398043 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.973048925 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.973284006 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.973387003 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.974241018 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.974320889 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.974394083 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.974894047 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.974981070 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.975356102 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.975462914 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.975975990 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.976052999 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.976300001 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.977299929 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.977341890 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.977399111 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.978135109 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.978199005 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.978370905 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.979317904 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.979406118 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.979993105 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.980251074 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.980314970 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.981009007 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.981220007 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.981276035 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.982320070 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.983086109 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.983279943 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.983318090 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.984030008 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.984297991 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.984373093 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.985313892 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.985410929 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.985667944 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.986551046 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.986592054 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.986716032 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.987770081 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.987849951 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.987857103 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.988768101 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.989043951 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.989310026 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.989506960 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.989573956 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.990438938 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.990820885 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.990888119 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.991312027 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.991499901 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.991559982 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.992625952 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.993520021 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.993634939 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.993638039 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.993664026 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.993714094 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.994067907 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.995055914 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.995143890 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.995362043 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.995438099 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.996419907 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.996462107 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.996531963 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.997370958 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.997519970 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.997543097 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.997602940 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.998109102 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.998164892 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.998275042 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.998338938 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.999382973 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.999423981 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:40.999465942 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:40.999495983 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.000221968 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.000294924 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.000987053 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.001257896 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.001327991 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.002115011 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.002188921 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.003251076 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.003288031 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.003334999 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.003361940 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.003978014 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.004143953 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.004297018 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.004363060 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.004935980 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.004992962 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.005166054 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.005225897 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.006402969 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.006429911 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.006493092 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.007153988 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.007232904 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.007282019 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.007390022 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.008791924 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.009005070 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.009073019 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.009259939 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.009319067 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.010333061 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.010366917 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.010410070 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.010446072 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.011220932 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.011311054 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.011981010 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.012073994 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.012259960 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.012326002 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.013456106 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.013498068 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.013557911 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.263744116 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.263881922 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.292534113 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.292630911 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.293531895 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.293746948 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.293817043 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.294028997 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.294092894 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.294264078 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.294327021 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.294990063 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.295052052 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.295264006 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.295351982 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.310127974 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.310234070 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.311029911 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.311150074 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.311304092 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.311387062 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.312304974 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.312405109 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.313432932 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.313647985 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.313728094 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.314259052 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.314336061 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.314371109 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.314436913 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.315201998 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.315294027 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.316148996 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.316279888 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.316334009 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.316374063 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.316400051 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.316428900 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.316508055 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.316570044 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.317338943 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.317449093 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.318504095 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.318681002 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.318751097 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.319384098 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.319453001 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.320259094 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.320328951 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.320389032 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.320456028 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.321106911 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.321201086 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.322263956 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.322416067 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.323478937 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.323695898 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.323717117 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.323808908 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.324218035 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.324299097 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.325387955 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.325524092 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.325614929 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.326333046 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.326416016 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.327069998 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.327145100 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.327358007 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.327455044 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.346374989 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.346498013 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.347273111 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.347328901 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.347402096 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.347428083 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.348298073 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.348370075 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.348443985 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.349384069 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.350133896 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.350234985 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.350383997 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.350466013 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.359778881 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.359886885 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.360090971 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.360167027 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.360167980 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.360239029 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.360264063 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.360333920 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.360393047 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.360466003 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.360490084 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.360622883 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.360698938 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.362270117 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.362957954 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.363040924 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.363239050 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.363358021 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.364175081 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.364247084 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.364284992 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.364346027 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.365259886 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.365349054 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.366667032 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.366743088 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.366818905 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.367041111 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.367110014 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.373359919 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.373431921 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.373558044 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.374129057 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.374202967 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.375004053 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.375076056 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.381655931 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.384120941 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.384231091 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.384278059 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.384341955 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.386729002 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.386873960 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.386959076 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.387155056 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.387223959 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.387397051 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.387459993 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.388134003 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.388202906 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.389064074 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.389147043 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.391674995 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.391710997 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.391781092 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.393793106 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.394493103 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.394593000 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.397520065 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.397675037 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.398030996 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.398108959 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.398257017 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.398325920 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.399064064 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.399146080 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.399254084 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.399316072 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.401782990 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.401864052 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.406675100 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.406768084 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.407152891 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.407466888 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.407531977 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.409161091 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.409229040 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.409303904 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.409364939 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.410104036 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.410167933 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.410347939 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.411279917 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.411349058 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.414362907 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.414448977 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.415395021 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.415455103 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.416027069 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.416110992 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.416248083 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.416311026 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.417023897 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.417094946 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.417226076 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.417260885 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.417288065 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.417314053 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.418737888 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.418809891 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.418867111 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.418886900 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.418909073 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.418935061 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.419619083 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.420052052 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.420115948 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.420516968 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.421096087 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.421159029 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.421204090 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.421257019 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.421272039 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.421329975 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.421778917 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.421840906 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.422048092 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.422102928 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.422434092 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.422509909 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.422710896 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.422768116 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.423022985 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.423084974 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.430310011 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.430346012 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.430397987 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.430434942 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.439563990 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.439599991 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.439729929 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.440704107 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.440757990 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.440831900 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.441011906 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.441041946 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.441065073 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.441145897 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.441220999 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.441267014 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.441318035 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.441344976 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.441360950 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.441900015 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.442184925 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.442234039 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.442245007 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.443000078 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.443061113 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.443233013 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.443284035 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.443334103 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.443355083 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.446479082 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.448561907 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.449104071 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.449162006 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.452019930 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.452115059 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.452975988 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.453136921 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.453190088 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.453396082 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.811429977 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.812149048 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.812340021 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.812367916 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.813400030 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.813606977 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.814121962 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.814209938 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.815108061 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.815210104 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.816031933 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.816103935 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.816299915 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.817138910 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.817229986 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.817297935 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.826138020 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.826220036 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.826379061 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.826495886 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.826559067 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.826616049 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.826723099 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.826805115 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.826838017 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.826937914 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.827085018 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.827147961 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.827222109 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.827280045 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.827342987 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.829159975 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.829250097 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.829322100 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.832184076 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.832333088 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.833040953 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.833300114 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.833398104 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.834784985 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.834897041 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.834906101 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.834980011 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.835058928 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.835426092 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.836323023 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.836385965 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.836435080 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.836505890 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.837070942 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.837347984 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.837438107 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.838270903 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.838984966 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.839075089 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.839232922 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.840228081 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.840320110 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.840399027 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.841147900 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.841222048 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.841362953 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.842597961 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.843465090 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.843590975 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.843703985 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.843763113 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.844211102 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.844347000 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.845269918 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.845352888 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.845362902 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.845429897 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.846329927 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.846424103 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.846601963 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.847273111 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.848463058 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.848790884 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.848887920 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.849186897 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.849252939 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.849384069 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.850110054 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.850322962 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.850402117 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.851463079 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.851510048 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.851545095 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.852356911 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.852428913 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.853471994 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.853646994 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.853717089 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.854223967 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.855072021 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.855206013 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.855278969 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.855986118 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.856055021 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.856230021 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.857459068 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.857579947 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.857681990 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.859181881 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.859213114 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.859299898 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.859551907 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.859615088 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.859745979 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.860356092 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.861006021 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.861110926 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.861268044 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.861316919 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.862023115 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.863523960 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.863635063 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.863791943 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.872129917 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.872394085 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.872513056 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.872565985 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.872639894 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.872682095 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.872998953 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.873058081 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.873066902 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.873142958 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.873224020 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.873284101 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.873306036 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.873327017 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.873425961 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.873471975 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.873557091 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.873666048 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.873718023 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.873795986 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.873840094 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.873914003 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.874031067 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.874146938 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.874200106 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:41.882134914 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.882369041 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.882472992 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.882565975 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.882692099 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.882793903 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.882910967 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.883038998 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.883153915 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.883244991 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.883349895 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.883481026 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.883593082 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.883716106 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.883868933 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.884046078 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:41.895948887 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.151246071 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.151437998 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.151606083 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.153320074 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.153425932 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.153498888 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.154033899 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.154143095 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.155323982 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.155401945 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.156076908 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.156156063 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.156229973 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.161473036 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.161622047 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.161719084 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.162024021 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.162230968 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.162291050 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.163480997 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.163552046 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.163996935 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.164309978 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.164371967 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.164999962 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.165312052 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.165373087 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.166414022 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.166512012 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.167141914 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.167227030 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.168042898 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.168112993 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.168313026 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.169001102 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.169349909 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.169411898 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.171411991 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.172400951 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.172483921 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.173264980 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.173331022 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.173363924 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.174655914 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.174767017 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.174839973 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.178154945 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.180989027 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.181127071 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.181299925 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.181365967 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.183096886 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.193167925 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.193279028 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.193329096 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.193448067 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.193507910 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.193784952 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.193898916 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.193959951 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.194256067 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.194349051 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.194467068 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.194524050 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.194721937 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.194813013 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.194871902 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.202424049 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.202455997 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.202579975 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.202580929 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.202629089 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.202662945 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.202776909 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.202919006 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.202991962 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.203037024 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.203087091 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.203202963 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.203298092 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.203402042 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.203454018 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.204049110 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.204113960 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.205435991 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.205851078 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.206589937 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.219723940 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.220038891 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.220136881 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.220174074 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.220256090 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.220304012 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.220360994 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.220454931 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.220654964 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.220706940 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.220819950 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.220869064 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.220895052 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.221059084 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.221141100 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.221190929 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.221265078 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.221309900 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.229792118 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.229825020 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.229943037 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.229980946 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.230079889 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.230180025 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.230246067 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.230257988 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.230298042 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.230426073 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.230546951 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.230623007 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.230665922 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.230782986 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.230943918 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.230988979 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.231057882 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.231101036 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.231189013 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.231298923 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.231415033 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.231462955 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.231540918 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.231584072 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.231658936 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.232355118 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.233088017 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.233156919 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.233269930 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.233315945 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.234076977 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.235183001 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.235265970 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.235292912 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.236069918 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.236332893 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.236421108 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.237390995 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.238056898 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.238131046 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.238296986 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.238339901 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.239000082 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.239317894 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.239945889 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.240323067 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.250442028 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.250577927 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.250696898 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.250732899 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.250792980 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.250819921 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.250936985 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.251058102 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.251111984 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.251178980 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.251229048 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.251338959 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.251389027 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.251460075 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.254000902 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.254271984 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.254354954 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.254379988 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.254435062 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:42.254499912 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:42.302018881 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.427736998 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.774626017 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.774658918 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.774671078 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.774682999 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.774703026 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.774853945 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.774955988 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.774974108 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.774990082 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.775043011 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.775082111 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.775408983 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.777205944 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.778091908 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.779483080 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.779592991 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.779630899 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.779690027 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.780215025 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.780236959 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.780287027 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.780319929 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.780653954 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.780832052 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.783411980 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.783442020 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.783545971 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.783998966 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.784018040 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.784033060 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.784050941 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.784070969 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.784084082 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.784090042 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.784109116 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.784125090 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.784132957 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.784142017 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.784176111 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.784214020 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.784437895 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.784455061 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.784502983 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.785248995 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.785353899 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.789704084 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.789736986 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.789756060 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.789772987 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.789789915 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.789876938 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.789952993 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.790355921 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.790445089 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.790730953 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.790807962 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.791467905 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.791557074 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.791825056 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.791887999 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.792411089 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.792479992 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.793741941 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.793823957 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.794528008 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.794547081 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.794612885 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.794724941 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.795250893 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.795326948 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.796015024 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.796289921 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.796361923 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.797676086 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.798166990 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.798255920 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.798387051 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.798449993 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.799159050 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.799236059 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.799952030 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.800295115 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.800379038 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.801307917 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.802453995 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.802562952 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.802650928 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.802712917 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.803623915 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.803710938 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.803884029 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.804205894 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.804265976 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.805397987 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.806087017 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.806171894 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.806444883 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.807214975 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.807287931 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.808469057 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.808629036 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.808696985 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.808970928 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.809328079 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.809397936 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.810349941 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.811084032 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.811172962 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.811290026 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.812225103 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.812314987 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.813352108 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.813571930 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.813641071 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.814043999 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.823498011 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.823654890 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.823707104 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.823795080 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.823852062 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.824052095 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.824070930 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.824086905 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.824124098 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.824203968 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.824259996 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.824419975 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.824481964 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.824490070 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.824554920 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.824608088 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.824660063 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.824836969 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.824902058 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.824925900 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.824981928 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.825047016 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.825165987 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.825221062 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.825287104 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.825423956 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.825503111 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.826282024 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.826962948 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.827058077 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.827198982 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.828629017 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.828753948 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.829019070 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.829324007 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.829397917 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.830112934 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.830991030 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.831085920 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.831269979 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.832031965 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.832125902 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.833395958 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.833578110 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.833656073 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.839230061 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.839257956 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.839270115 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.839282990 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.839298964 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.839319944 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.839335918 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.839353085 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.839369059 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.839428902 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.839519978 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.840001106 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.840096951 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.840173006 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:43.840230942 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:43.865092993 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:44.126919031 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:44.286535978 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:44.610694885 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:44.610966921 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:48.612343073 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:48.802512884 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:48.874113083 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:49.050992966 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:49.051170111 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:49.249815941 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:51.458302975 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:51.599632025 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:51.884058952 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:51.884221077 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:53.621860027 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:53.802995920 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:54.051011086 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:54.051134109 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:54.447529078 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:54.826239109 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:58.622051954 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:58.803339958 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:59.059401035 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:59.059493065 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:18:59.526787043 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:18:59.600284100 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:19:03.631412983 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:19:03.803755045 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:19:04.071410894 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:19:04.071582079 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:19:05.191164017 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:19:05.566353083 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:19:07.623289108 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:19:07.804056883 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:19:08.061928988 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:19:08.064282894 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:19:08.623513937 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:19:08.804203033 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:19:09.077846050 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:19:09.078025103 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:19:10.337177038 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:19:10.751228094 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:19:13.631835938 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:19:13.789325953 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:19:14.085864067 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:19:14.086774111 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:19:15.368129969 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:19:15.691028118 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:19:15.742217064 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:19:15.750962973 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:19:18.637079954 CEST	2092	49730	23.105.131.142	192.168.2.5
Jun 10, 2021 10:19:18.680047035 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:19:20.383753061 CEST	49730	2092	192.168.2.5	23.105.131.142
Jun 10, 2021 10:19:20.757041931 CEST	2092	49730	23.105.131.142	192.168.2.5

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 20014464370.PDF.exe PID: 5480 Parent PID: 5916

General

Start time:	10:17:01
Start date:	10/06/2021
Path:	C:\Users\user\Desktop\20014464370.PDF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\20014464370.PDF.exe'
Imagebase:	0xe10000
File size:	675888 bytes
MD5 hash:	CAC542CD84BE91EA0ACFB9CD1964397D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000002.342623985.00000000041FC000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000001.00000002.341859487.0000000003161000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000001.00000000.218918618.0000000000E12000.00000002.00020000.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.342734107.00000000042DD000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000002.342734107.00000000042DD000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000002.342734107.00000000042DD000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000001.00000002.341051840.0000000000E12000.00000002.00020000.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.342922605.000000000437C000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000002.342922605.000000000437C000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000002.342922605.000000000437C000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 5612 Parent PID: 5480

General

Start time:	10:17:58
Start date:	10/06/2021
Path:	C:\Users\user\AppData\Local\Temp\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\RegAsm.exe gyujnbgh
Imagebase:	0x440000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.508404585.0000000005220000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000C.00000002.508404585.0000000005220000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.509028437.0000000006560000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000C.00000002.509028437.0000000006560000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.508963267.0000000006520000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000C.00000002.508963267.0000000006520000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.508342634.00000000051F0000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000C.00000002.508342634.00000000051F0000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.508356430.0000000005200000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000C.00000002.508356430.0000000005200000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.508139093.0000000004F80000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000C.00000002.508139093.0000000004F80000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.508139093.0000000004F80000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000000.340662970.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000000.340662970.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000000.340662970.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.498724882.0000000002731000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000000.339849220.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000000.339849220.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000000.339849220.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.508978041.0000000006530000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000C.00000002.508978041.0000000006530000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.508467673.0000000005250000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000C.00000002.508467673.0000000005250000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.504714336.000000000432F000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.504714336.000000000432F000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.508108370.0000000004F70000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000C.00000002.508108370.0000000004F70000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.509043380.0000000006570000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000C.00000002.509043380.0000000006570000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.503817122.0000000003FFE000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.503817122.0000000003FFE000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.508990820.0000000006540000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000C.00000002.508990820.0000000006540000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.503247081.0000000003731000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.503247081.0000000003731000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.508451814.0000000005240000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000C.00000002.508451814.0000000005240000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000C.00000002.509338103.0000000006C1C000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.493405932.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.493405932.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.493405932.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.508629806.0000000005C10000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000C.00000002.508629806.0000000005C10000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.504360558.00000000041CE000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.504360558.00000000041CE000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.509088108.00000000065B0000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000C.00000002.509088108.00000000065B0000.00000004.00000001.sdmp, Author: Florian Roth Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.504504197.0000000004244000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 0%, Virustotal, Browse Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	high

Chronological Activities

Analysis Process: lkjhgfs.exe PID: 1848 Parent PID: 3472

General

Start time:	10:18:07
Start date:	10/06/2021
Path:	C:\Users\user\AppData\Local\lkjhgfs.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\lkjhgfs.exe'
Imagebase:	0x7b0000
File size:	675888 bytes
MD5 hash:	CAC542CD84BE91EA0ACFB9CD1964397D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000F.00000000.359197318.00000000007B2000.00000002.00020000.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000F.00000002.489565052.0000000003E8E000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000F.00000002.489565052.0000000003E8E000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000F.00000002.489565052.0000000003E8E000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000F.00000002.486837759.0000000002C00000.00000004.00000001.sdmp, Author: Florian Roth Rule: NanoCore, Description: unknown, Source: 0000000F.00000002.486837759.0000000002C00000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000F.00000002.486775398.0000000002BB1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000F.00000002.485697797.00000000007B2000.00000002.00020000.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000F.00000002.487979449.0000000003D0E000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000F.00000002.487979449.0000000003D0E000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000F.00000002.487979449.0000000003D0E000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000F.00000002.488625589.0000000003DEF000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000F.00000002.488625589.0000000003DEF000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000F.00000002.488625589.0000000003DEF000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: C:\Users\user\AppData\Local\lkjhgfs.exe, Author: Joe Security
Antivirus matches:	Detection: 15%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: lkjhgfs.exe PID: 5188 Parent PID: 3472

General

Start time:	10:18:15
Start date:	10/06/2021
Path:	C:\Users\user\AppData\Local\lkjhgfs.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\lkjhgfs.exe'
Imagebase:	0x540000
File size:	675888 bytes
MD5 hash:	CAC542CD84BE91EA0ACFB9CD1964397D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000011.00000000.377243556.0000000000542000.00000002.00020000.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000011.00000002.499016642.00000000029A0000.00000004.00000001.sdmp, Author: Florian Roth Rule: NanoCore, Description: unknown, Source: 00000011.00000002.499016642.00000000029A0000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000011.00000002.504178420.0000000003C2E000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000011.00000002.504178420.0000000003C2E000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000011.00000002.504178420.0000000003C2E000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000011.00000002.493302996.0000000000542000.00000002.00020000.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000011.00000002.504008398.0000000003B8F000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000011.00000002.504008398.0000000003B8F000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000011.00000002.504008398.0000000003B8F000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000011.00000002.498841834.0000000002951000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000011.00000002.503763443.0000000003AAE000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000011.00000002.503763443.0000000003AAE000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000011.00000002.503763443.0000000003AAE000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: AAAstarupxxzzzgb.exe PID: 3604 Parent PID: 5612

General

Start time:	10:18:51
Start date:	10/06/2021
Path:	C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe'
Imagebase:	0x50000
File size:	555384 bytes
MD5 hash:	C7330A70647D84A218BBE2E6D245DCE3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000016.00000002.497639798.0000000002441000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000016.00000002.493379288.0000000000052000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000016.00000000.453300542.0000000000052000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: C:\Users\user\AppData\Local\Temp\AAAstarupxxzzzgb.exe, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 964 Parent PID: 1848

General

Start time:	10:19:05
Start date:	10/06/2021
Path:	C:\Users\user\AppData\Local\Temp\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\RegAsm.exe gyujnbgh
Imagebase:	0xa40000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000017.00000000.484413891.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000017.00000000.484413891.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000017.00000000.484413891.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000017.00000002.498671862.0000000002DA1000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000017.00000002.498671862.0000000002DA1000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000017.00000002.493387609.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000017.00000002.493387609.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000017.00000002.493387609.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000017.00000002.498968741.0000000003DA9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000017.00000002.498968741.0000000003DA9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000017.00000000.485173449.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000017.00000000.485173449.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000017.00000000.485173449.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 20014464370.PDF.exe PID: 5480 Parent PID: 5916 20014464370.PDF.exeCOMMON

Executed Functions

Function 05ADC820, Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,?,?), ref: 05ADC8C7

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID: ChildEnumWindows
String ID:
API String ID: 3555792229-0
Opcode ID: 402ce66171c18c55eea424ce34fb44be8db3f6f944bf298ff6bafd6db9dfc030
Instruction ID: 3deffceb69f193211f6c3535a2ca12fa1239370ca401a6d5d51671ebe854cf91
Opcode Fuzzy Hash: 402ce66171c18c55eea424ce34fb44be8db3f6f944bf298ff6bafd6db9dfc030
Instruction Fuzzy Hash: C831CBB4D052589FCB14CFA9E584AEEFBB1BF49310F14902AE415B7310C734A945CF68

Uniqueness

Uniqueness Score: -1.00%

Function 015F2B20, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015F2B57

Memory Dump Source

Source File: 00000001.00000002.341651635.00000000015F0000.00000040.00000001.sdmp, Offset: 015F0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 083427fcb6e448fbd4d6e7ef8184efcfb7338f67145fdd444b66c2411f67b09d
Instruction ID: 3cc725f4ddc4e0c3706ab1a4f2c94592ceba774f82352308b99f2bcc6f1da7c3
Opcode Fuzzy Hash: 083427fcb6e448fbd4d6e7ef8184efcfb7338f67145fdd444b66c2411f67b09d
Instruction Fuzzy Hash: D9115770B00108CFCB18DF69C4589AEBBF2BF89614F2108A9E502EF760CB71DC418BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0311BDF8, Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

8L, xrefs: 0311BEC8

Memory Dump Source

Source File: 00000001.00000002.341802745.0000000003110000.00000040.00000001.sdmp, Offset: 03110000, based on PE: false

Similarity

API ID:
String ID: 8L
API String ID: 0-2968850700
Opcode ID: 812dea8e3fb0397c918ce944a3f33f482bc29f16d884fb9280ff7325376a5011
Instruction ID: 7cb22758831351e2f829802cb5ea5c3c4f2aff8f6526d9642c5ac6d254f5ea91
Opcode Fuzzy Hash: 812dea8e3fb0397c918ce944a3f33f482bc29f16d884fb9280ff7325376a5011
Instruction Fuzzy Hash: 7CA13A70D0A208CFDB18CFA5E049BADBBB5EB4D304F01C869D625AB354D77859A9CF81

Uniqueness

Uniqueness Score: -1.00%

Function 05AD5630, Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

mt<", xrefs: 05AD57E7

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID:
String ID: mt<"
API String ID: 0-493029461
Opcode ID: 6ce7ad7f4eed0ed16af074f474b6e207200cc939a34fe035659a7bb320659d61
Instruction ID: 22010af30ee01b86ac4544990a49e37a05260084afeff0c640098caa5d2c3a3a
Opcode Fuzzy Hash: 6ce7ad7f4eed0ed16af074f474b6e207200cc939a34fe035659a7bb320659d61
Instruction Fuzzy Hash: D1911274D05218CFDB24EFAAD884AADFBF6BB4D310F14956AD41AAB345DB305885CF20

Uniqueness

Uniqueness Score: -1.00%

Function 05AD5621, Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

mt<", xrefs: 05AD57E7

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID:
String ID: mt<"
API String ID: 0-493029461
Opcode ID: 2a915ff4d880960fc85afab5a54d0d07a1ebb50fcd26ca469e50fe10b80ccd81
Instruction ID: 247ab6f505c2a6e756d3aac684ece37e9d54c8e71b0776ef1269612c0060034e
Opcode Fuzzy Hash: 2a915ff4d880960fc85afab5a54d0d07a1ebb50fcd26ca469e50fe10b80ccd81
Instruction Fuzzy Hash: C7910274D05218CFDB24DFAAD884AADFBF2BB8D310F14956AD41AAB355DB305885CF20

Uniqueness

Uniqueness Score: -1.00%

Function 0311B898, Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341802745.0000000003110000.00000040.00000001.sdmp, Offset: 03110000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f18419835374eed862e5da9cd191a299391ede3d80efe8fe9364407f1ac08f3
Instruction ID: 981754b2e072ed6fa5855f20d11d2637ba139fc218c234954fb14e4241486e0b
Opcode Fuzzy Hash: 5f18419835374eed862e5da9cd191a299391ede3d80efe8fe9364407f1ac08f3
Instruction Fuzzy Hash: 8FD1F2B0D0921CCFDB24DFA5E8887EDBBB5FB49304F1190A9D419AB254DB741A9ACF40

Uniqueness

Uniqueness Score: -1.00%

Function 05AD5DD0, Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2cffc5fdc8736bed078e9bd468ccf39e53c4ef7a76c0ce918888b49f51a4608
Instruction ID: d91b9df3b6448fd7afa669140a36f7cdb9f0b6ce464e231ad4af6356b3b52d86
Opcode Fuzzy Hash: d2cffc5fdc8736bed078e9bd468ccf39e53c4ef7a76c0ce918888b49f51a4608
Instruction Fuzzy Hash: A2A1E174D05228CFDB20EF24E948BA9FBB6BB4D301F0091E9D55AA7251DB749E84CF24

Uniqueness

Uniqueness Score: -1.00%

Function 05AD5E19, Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1ed36bba4805614af0cd4f6793120659d8e4c9d95338476220e4f36b006c57d
Instruction ID: 039a2116eff58eca81fa3a18715f24cd1bcc64c7772c68cf96241dfdfb1695de
Opcode Fuzzy Hash: d1ed36bba4805614af0cd4f6793120659d8e4c9d95338476220e4f36b006c57d
Instruction Fuzzy Hash: D5A1E174D05228CFDB60EF24E958BADFBB2BB49301F0091D9D55AA7291CB749E84CF24

Uniqueness

Uniqueness Score: -1.00%

Function 05ADC938, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136fa06cbaaea41d78e556cdf13522258d09172689118393e5d6ed8ddcef7084
Instruction ID: 63061b46a2d91e07d62ff0b4f49d595b76b6e27c2d213e7f8702ad5f451fed08
Opcode Fuzzy Hash: 136fa06cbaaea41d78e556cdf13522258d09172689118393e5d6ed8ddcef7084
Instruction Fuzzy Hash: 4A214CB8D04218DFCB14DFA9D88499EFBF1BB49320F14A16AE815B7360D7349941CF58

Uniqueness

Uniqueness Score: -1.00%

Function 05ADAE30, Relevance: 1.8, APIs: 1, Instructions: 321processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05ADB0F7

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3c909f92ad8b77835f1b8cec00dac120e9efbb6a48d999bd6252adf85f6d3a6e
Instruction ID: 9950c55ddcbf575b3f118e26f65b261ab52787478ed3d113f6d0ba3af063ad01
Opcode Fuzzy Hash: 3c909f92ad8b77835f1b8cec00dac120e9efbb6a48d999bd6252adf85f6d3a6e
Instruction Fuzzy Hash: 6AC14571D0426D8FCB20DFA5C840BEEBBB1BF49304F0185A9E55AB7250DB749A85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05ADBF38, Relevance: 1.7, APIs: 1, Instructions: 158COMMON

Download Yara Rule

APIs

K32GetModuleBaseNameA.KERNEL32(?,?,?,?), ref: 05ADC0A7

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: ef5ba141718bd7a9cc54abd7f8057b05ecb83b4610564ce7b79533587295efc6
Instruction ID: 5387e6a91dfb43428177f61855735d1c173ca4dd478aeb16dec908d859ce1327
Opcode Fuzzy Hash: ef5ba141718bd7a9cc54abd7f8057b05ecb83b4610564ce7b79533587295efc6
Instruction Fuzzy Hash: 0561DE74D04218DFCB24DFA9D890B9DFBF1BB49314F10812AE829AB351DB74A946CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05ADAB78, Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05ADAC4B

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 840cef05db3f316b0a63ed527d6b8d00928b0bfc3e2d92f00c87de76ccd248f7
Instruction ID: e1c9d33061c105c06e63e897760d275b052865d6b908005dcfd43b8671d69245
Opcode Fuzzy Hash: 840cef05db3f316b0a63ed527d6b8d00928b0bfc3e2d92f00c87de76ccd248f7
Instruction Fuzzy Hash: 2C41A8B5D052589FCF00CFA9D984AEEFBF1BB49314F14902AE819B7210D778AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05AD6761, Relevance: 1.6, APIs: 1, Instructions: 109fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 05AD683E

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 7275b4b75026372897ffc065163d17529d89361ca025c5b01f93b19ce27b9287
Instruction ID: 1e66592bf47d7b458b36e46f0f0f2b66f07fc486ac7f2cf5c8665916c367a1aa
Opcode Fuzzy Hash: 7275b4b75026372897ffc065163d17529d89361ca025c5b01f93b19ce27b9287
Instruction Fuzzy Hash: A541ADB5D04259DFCB10CFAAD484AEEFBF1BB49314F14806AE455B7260D334AA86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05AD6768, Relevance: 1.6, APIs: 1, Instructions: 107fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 05AD683E

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 41f1ebdeb207ebaa1655cd174b69f9a1a13099d1e1c8f5967069247c46c2ea0d
Instruction ID: 053647ef5fad7b578721992cfdc7ee5248b93dcd898dca2601ff143279b1d9fe
Opcode Fuzzy Hash: 41f1ebdeb207ebaa1655cd174b69f9a1a13099d1e1c8f5967069247c46c2ea0d
Instruction Fuzzy Hash: 3E41ADB4D04258DFCB10CFAAD484AEEFBF1BB49314F14806AE455B7260D334A986CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05ADAA28, Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05ADAAD2

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b46aceed17e9c5d10557f7e60b1ea000356081a0c78d5fd3cab8cc128676a315
Instruction ID: 50770396968657c2dc9d9b7d08edfd86cb61f5d28097fdfe70bc98c74f2849d4
Opcode Fuzzy Hash: b46aceed17e9c5d10557f7e60b1ea000356081a0c78d5fd3cab8cc128676a315
Instruction Fuzzy Hash: 1E3186B9D042589FCF10CFA9D984ADEFBB1BB49310F10A42AE815B7310D735A946CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 03111559, Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 03111604

Memory Dump Source

Source File: 00000001.00000002.341802745.0000000003110000.00000040.00000001.sdmp, Offset: 03110000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7aeebff2cc9f8a5b4938a8171caa07677ec6578c65abd2b8ebad1d1974075cae
Instruction ID: c56d2461071d5f3c1583c9e594be52a027b3453f7537df7baf8dda88978cc427
Opcode Fuzzy Hash: 7aeebff2cc9f8a5b4938a8171caa07677ec6578c65abd2b8ebad1d1974075cae
Instruction Fuzzy Hash: 9131C7B4D04248AFCF14CFA9D980AEEFBB1BF49310F14902AE815B7210C775A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05ADB6B0, Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?), ref: 05ADB770

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 320f7db5d630ac384d543e741b97116e778c8c88d096d8ac157dadb9c3c08e70
Instruction ID: d83446057e21b3ecfecfcf3ea20eb2c33bd49d2baeaf1ae55c066206e50432a7
Opcode Fuzzy Hash: 320f7db5d630ac384d543e741b97116e778c8c88d096d8ac157dadb9c3c08e70
Instruction Fuzzy Hash: D64188B8D052589FCB10CFAAD984ADEFBF1BB49310F14902AE419B7210D374AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05ADBD78, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,?,?,?), ref: 05ADBE1E

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: 96196fa5e3dfb87a5d86aaf2d500f62f29348cebc55458aef8259f358e77d948
Instruction ID: 5322b91ef19245113b784e00971d039d97617f7906b96857900e7bb3cca21dfa
Opcode Fuzzy Hash: 96196fa5e3dfb87a5d86aaf2d500f62f29348cebc55458aef8259f358e77d948
Instruction Fuzzy Hash: 083186B9D042589FCF10CFAAD984AEEFBB1BB09310F14902AE915B7310D774A946CF65

Uniqueness

Uniqueness Score: -1.00%

Function 03111560, Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 03111604

Memory Dump Source

Source File: 00000001.00000002.341802745.0000000003110000.00000040.00000001.sdmp, Offset: 03110000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 56f64fbdb22678ef1f0f2fb0edbecbcbc4c68db0fec69c5b9f043fb611efbdc3
Instruction ID: c9b5e16edd2df82737855d542683fbd5eb6632f97f98f2c0bca82a7bfbaf89a3
Opcode Fuzzy Hash: 56f64fbdb22678ef1f0f2fb0edbecbcbc4c68db0fec69c5b9f043fb611efbdc3
Instruction Fuzzy Hash: F231A7B4D05258AFCF10CFA9D980ADEFBB1BB49310F14902AE914B7210D775A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05ADA870, Relevance: 1.6, APIs: 1, Instructions: 94threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,?), ref: 05ADA91F

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: d456eac4468cb442cb2eb551cb0376a3b9d5ce2c82f62bfd6a7a21e1dba01ad7
Instruction ID: a9405b5cac0c86c47a4032dc68b3a63b3e1c51c337ea3203ef73580ae1efc783
Opcode Fuzzy Hash: d456eac4468cb442cb2eb551cb0376a3b9d5ce2c82f62bfd6a7a21e1dba01ad7
Instruction Fuzzy Hash: F131ACB4D052589FCB10DFA9D984AEEFBF1BF48314F14802AE415B7240D778A985CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 03111828, Relevance: 1.6, APIs: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 031118AE

Memory Dump Source

Source File: 00000001.00000002.341802745.0000000003110000.00000040.00000001.sdmp, Offset: 03110000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 82118de943823793c225be6d7bfa795f0c89a44d7233b26808497a8b66996430
Instruction ID: 84370b79d226b8af3f1bafae802d29c0f3eca2fe982171810c833836e0188b2b
Opcode Fuzzy Hash: 82118de943823793c225be6d7bfa795f0c89a44d7233b26808497a8b66996430
Instruction Fuzzy Hash: D631D8B4D00258AFCB14CFA9D980AEEFBB5BF48314F14802AE915B3310C774A841CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 03111830, Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 031118AE

Memory Dump Source

Source File: 00000001.00000002.341802745.0000000003110000.00000040.00000001.sdmp, Offset: 03110000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d015806d41605df9a2714fb493f471c825c8dfb6a9f04837585bd30d331c8312
Instruction ID: d8ca1610d60b3dc1e9af49234df06be59b515f6e6fe1db4874153c93fd271c19
Opcode Fuzzy Hash: d015806d41605df9a2714fb493f471c825c8dfb6a9f04837585bd30d331c8312
Instruction Fuzzy Hash: 8431C9B4D05258AFCB14CFAAD980AEEFBB4BB48314F14802AE915B7300C774A845CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05ADC218, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 05ADC295

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e58818d69213e73e893b197d98d7ebdd52093966ba946592f333819db3b00742
Instruction ID: 7cdc72c137061fe34963b2fa518c47a9c34cf2d6ad626ab48d8168d53c9e6e34
Opcode Fuzzy Hash: e58818d69213e73e893b197d98d7ebdd52093966ba946592f333819db3b00742
Instruction Fuzzy Hash: 613198B4D052589FCB10DFA9D584AEEFBF4BB09324F14846AE815B3310C774A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 015F2B10, Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015F2B57

Memory Dump Source

Source File: 00000001.00000002.341651635.00000000015F0000.00000040.00000001.sdmp, Offset: 015F0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e47aeaf5e3086f9894ddc66597f403d4a49c6100e510de819bea1911e1bc3f27
Instruction ID: 40a8cabd9435980d0f85d7a9d9cd86cf71053e8f7e6839dbaa98f773a9b4394a
Opcode Fuzzy Hash: e47aeaf5e3086f9894ddc66597f403d4a49c6100e510de819bea1911e1bc3f27
Instruction Fuzzy Hash: E1116A30A44218CFCB15DF78C444AAD7BF2BF8A614B1504A9E402EF760CB71DC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 015F2BE9, Relevance: 1.5, APIs: 1, Instructions: 43libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015F2B57

Memory Dump Source

Source File: 00000001.00000002.341651635.00000000015F0000.00000040.00000001.sdmp, Offset: 015F0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0dbbc36f41276af9424d79c86ebc60fd1f28acc9785ad42917442529c3449f35
Instruction ID: 959716af78ca0bfd4f39b6c8ea8ff38798d78d41407316583f2f2344f037e06f
Opcode Fuzzy Hash: 0dbbc36f41276af9424d79c86ebc60fd1f28acc9785ad42917442529c3449f35
Instruction Fuzzy Hash: D5015AB0A40108CFC714DFA8C498AEDBBF5BF99254B6508ADE506AF721CB71DD428B91

Uniqueness

Uniqueness Score: -1.00%

Function 0156D558, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341578982.000000000156D000.00000040.00000001.sdmp, Offset: 0156D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a6c4c1354945d4dcf348248c0cfe9ae31f41b6bd6556859a0a3fbcdff11fa2
Instruction ID: be1766a27749f616835bc638a2588608c224783cd455be35c73b816cca2f2794
Opcode Fuzzy Hash: 03a6c4c1354945d4dcf348248c0cfe9ae31f41b6bd6556859a0a3fbcdff11fa2
Instruction Fuzzy Hash: 332148B1604240DFDB11DF54D9C0B1ABFB9FB98318F248969D9494F206C336D846C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 0156D644, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341578982.000000000156D000.00000040.00000001.sdmp, Offset: 0156D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697f30bfebc0f463297180114a328c1983d3be7885baa2edb0f364ae05e202f8
Instruction ID: 72b58d4f31927f00df76c98646eea86173ac4267bab1ba8780517de0dbc6c325
Opcode Fuzzy Hash: 697f30bfebc0f463297180114a328c1983d3be7885baa2edb0f364ae05e202f8
Instruction Fuzzy Hash: 572128B5604284DFDB11CF94D9C0B1ABFB9FB88324F248969D9494F246C33AD855C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 0157D01C, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341593155.000000000157D000.00000040.00000001.sdmp, Offset: 0157D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71b3ad1aa414d1f4b42a66cb1768f44296d5921f96886c6d495e55362df994f
Instruction ID: db59481bc3b21c51bc27dd808c0899208c6c749a6c6986614c665cd89b6f4c50
Opcode Fuzzy Hash: c71b3ad1aa414d1f4b42a66cb1768f44296d5921f96886c6d495e55362df994f
Instruction Fuzzy Hash: 782168B15082409FD712DF58E9C0B2ABBB5FFC4354F24C669D9494F201D336D807C661

Uniqueness

Uniqueness Score: -1.00%

Function 0157D006, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341593155.000000000157D000.00000040.00000001.sdmp, Offset: 0157D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b9bb1c8e5534366c1e19fcc54caec8cc88c3f7fc5801bb2a396f618a8314dd
Instruction ID: 43256ab89ea8b7ab705dc69a3e5ecb35cf06c9a8fee58bfca86fd7bc9f789678
Opcode Fuzzy Hash: 84b9bb1c8e5534366c1e19fcc54caec8cc88c3f7fc5801bb2a396f618a8314dd
Instruction Fuzzy Hash: CD2163765093C08FD713DF24D994719BF71FF86254F2985EAC8848B657C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0156D553, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341578982.000000000156D000.00000040.00000001.sdmp, Offset: 0156D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6866c8b08434bdbd5fa1578fb5b946e87ca1ac65ff923eebbf5c9b940695a3d8
Instruction ID: 8de9cb7370225e0563f2b80bed3d6b9339d235d7828a848e7f98400c7eeafe66
Opcode Fuzzy Hash: 6866c8b08434bdbd5fa1578fb5b946e87ca1ac65ff923eebbf5c9b940695a3d8
Instruction Fuzzy Hash: 0F11B176904280CFDB12CF54D9C4B1ABF71FB88324F2486A9D9494F65BC336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0156D63F, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341578982.000000000156D000.00000040.00000001.sdmp, Offset: 0156D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6866c8b08434bdbd5fa1578fb5b946e87ca1ac65ff923eebbf5c9b940695a3d8
Instruction ID: 66dc34c459b0cd641cf6caec03fc8885ccbd53d6e1ff1546502b3a039b08e4aa
Opcode Fuzzy Hash: 6866c8b08434bdbd5fa1578fb5b946e87ca1ac65ff923eebbf5c9b940695a3d8
Instruction Fuzzy Hash: 1511B176904280CFDB12CF54D9C4B1ABF71FB84324F2886A9D9494B657C33AD45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03111980, Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

w, xrefs: 03111F50
U, xrefs: 03111F80

Memory Dump Source

Source File: 00000001.00000002.341802745.0000000003110000.00000040.00000001.sdmp, Offset: 03110000, based on PE: false

Similarity

API ID:
String ID: U$w
API String ID: 0-2864656496
Opcode ID: 3b05cab5cc6034a625431ac8e4882d87edd5fe2f95ae630a514c6a8bc4d53fce
Instruction ID: 9d734665f91847c4359a541526061f5b1d684f6ec2d932de8e8d0016886b977b
Opcode Fuzzy Hash: 3b05cab5cc6034a625431ac8e4882d87edd5fe2f95ae630a514c6a8bc4d53fce
Instruction Fuzzy Hash: 1E91C270D05628CFEB68CF2AD948BDAFBF6BB89305F0481E9C50DA6254DB701A958F50

Uniqueness

Uniqueness Score: -1.00%

Function 05AD0040, Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

+, xrefs: 05AD034F

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: 0b0846d85c417575554d86f428de55d563ef96e126a46385d17cdbaeab92ee91
Instruction ID: 0291f24a05cc538c5edac7ff40586469c27e2a291c6a7c0d20f7bdee1b465ef5
Opcode Fuzzy Hash: 0b0846d85c417575554d86f428de55d563ef96e126a46385d17cdbaeab92ee91
Instruction Fuzzy Hash: F431E7B1D056188BDB28DF6B884469EFAF7BFC8300F04C1A9D51DA7255EB304A858F64

Uniqueness

Uniqueness Score: -1.00%

Function 05AD4F18, Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c8c8a716456ad2fa126fdf6b7bd9e2652e2fb23084ba01e49f08a465d3d57f
Instruction ID: 56fe1393f2b52e31338c61951d5166c6397c77a12af830e8bc13d0dd08768af2
Opcode Fuzzy Hash: 69c8c8a716456ad2fa126fdf6b7bd9e2652e2fb23084ba01e49f08a465d3d57f
Instruction Fuzzy Hash: E622B271E046199FDB18DFAAC980A9DFBF2BF88304F24C169D419EB21AD7349946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 015F3328, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341651635.00000000015F0000.00000040.00000001.sdmp, Offset: 015F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d662c9ab7b5abd0282e9110dfffa7c22764bb204f5b22b7181dad481c90781
Instruction ID: 1eba004bb2a4d6b8d84254c11a635464c90aaef3e12c97c23b90ebf27ff94c07
Opcode Fuzzy Hash: c7d662c9ab7b5abd0282e9110dfffa7c22764bb204f5b22b7181dad481c90781
Instruction Fuzzy Hash: 6E815870A04245CFD748DFAAE945A9EBBF3FBC9204F05C529C1189F268EB349849CF85

Uniqueness

Uniqueness Score: -1.00%

Function 015F3338, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341651635.00000000015F0000.00000040.00000001.sdmp, Offset: 015F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02df90075a452c773291ce64b02cbd076bcabf096d9201c72622dad185f0863d
Instruction ID: ac0da0deba298f083760374ad2fbb6a1a25af4fa5dcca7b3d631b7d8a2a3eed2
Opcode Fuzzy Hash: 02df90075a452c773291ce64b02cbd076bcabf096d9201c72622dad185f0863d
Instruction Fuzzy Hash: D5812970A04245CFD748DFAAE94569EBBF3FBC9204F01C529C119DF268EB3498499F45

Uniqueness

Uniqueness Score: -1.00%

Function 05AD4F09, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd8fb74f250a32cb0980afa353b5c94511939acc208a93f16178c149fe67b31
Instruction ID: bc912a8c2148d8a0c672c4a2df4383ea262a2dfd3074b6cf1825e376f9bb0af8
Opcode Fuzzy Hash: 5fd8fb74f250a32cb0980afa353b5c94511939acc208a93f16178c149fe67b31
Instruction Fuzzy Hash: 0D5157B1E056198BDB58CFABC94069EFBF3BFC8300F14C17A9918AB215EB3459418F54

Uniqueness

Uniqueness Score: -1.00%

Function 03111105, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341802745.0000000003110000.00000040.00000001.sdmp, Offset: 03110000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ab57edc982a2b122da4dfce0484e4e54c8eea8dd27f159c16dcd44bf754ab6
Instruction ID: 2d3641523054852ec1f08d55577c60d7f7f604bea379bb27e326d3d6fc46a4d1
Opcode Fuzzy Hash: a5ab57edc982a2b122da4dfce0484e4e54c8eea8dd27f159c16dcd44bf754ab6
Instruction Fuzzy Hash: 3E41FCB4D04248AFDB10CFA9D884BEEFBF1BB49304F24812AE815AB250D7749885CF44

Uniqueness

Uniqueness Score: -1.00%

Function 03111110, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341802745.0000000003110000.00000040.00000001.sdmp, Offset: 03110000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9e24cc5c25842cc37ce96ce0922f8ffe130fbc23bf8af1d47ae41c8b82bf9a
Instruction ID: 70aeb6363cb7a3fe2afe497689050256b323ee7d65ac2dbbcfdbb1282ee41fe6
Opcode Fuzzy Hash: cb9e24cc5c25842cc37ce96ce0922f8ffe130fbc23bf8af1d47ae41c8b82bf9a
Instruction Fuzzy Hash: 1241ECB4D04648AFDB14CFA9D984BDEFBF1BB49304F24812AE815BB250D7749885CF85

Uniqueness

Uniqueness Score: -1.00%

Function 05AD73EB, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 772dbd821107dc5bccfed4aa10acda9020d8675df7d33c7103550b622deed9c0
Instruction ID: 884a3861df784c268223732959888966626df149758052119aff3ea00d82bd8b
Opcode Fuzzy Hash: 772dbd821107dc5bccfed4aa10acda9020d8675df7d33c7103550b622deed9c0
Instruction Fuzzy Hash: 69212B71D096648BEB29DF6BCC1579AFAF7EFC9300F04C4FA844DAA265DA3049858F11

Uniqueness

Uniqueness Score: -1.00%

Function 05AD0006, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caca9996acbbb0365c067f7fefadad2738eda64893f19d945af530d3ae90cd0f
Instruction ID: 402f675a8447a653911336f628b75354f3a09a1ecc423c8901c0eef11de681f8
Opcode Fuzzy Hash: caca9996acbbb0365c067f7fefadad2738eda64893f19d945af530d3ae90cd0f
Instruction Fuzzy Hash: F231FDB1D067548FDB59CF66CC4129ABFF3AFC5200F09C0FAC5099A256E6340946CF25

Uniqueness

Uniqueness Score: -1.00%

Function 03111973, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.341802745.0000000003110000.00000040.00000001.sdmp, Offset: 03110000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f1c2a01c07b852370e6cd9079a5bf3f3cadfe500b29da960bcd433054e57bad
Instruction ID: cd625d7d81c50469e07fd1704557be54b0a21d3bb0f7d2e51f030ddaa1cfe4bf
Opcode Fuzzy Hash: 7f1c2a01c07b852370e6cd9079a5bf3f3cadfe500b29da960bcd433054e57bad
Instruction Fuzzy Hash: D33183B1D056588AEB68CF6BDD4478AFAF3AFC8304F14C1FAC40CA6255EB351A858F50

Uniqueness

Uniqueness Score: -1.00%

Function 05AD7390, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a76fe5c7b71b736c5075fa27ff6aeac1090986d8e25c541837bee5c95fe292
Instruction ID: 71a6832ab3ad499cb4b7d482bfbb9e37ece1a32580f714c4a25721f7b9398098
Opcode Fuzzy Hash: 12a76fe5c7b71b736c5075fa27ff6aeac1090986d8e25c541837bee5c95fe292
Instruction Fuzzy Hash: 57210871D0A6648BDB1ADF6B98547DABFB3AFCA314F09C0E6C4489A126D7300946CF11

Uniqueness

Uniqueness Score: -1.00%

Function 05AD7430, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.345812832.0000000005AD0000.00000040.00000001.sdmp, Offset: 05AD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8afbc4274c9cc430fbc562d31bc3ac0af8895421c76893dc139c890ea3d92eb4
Instruction ID: 9b58c5b10d7193749923a7a4025e4e24bd7aac68ecf1c64b1c832b486b83ca2e
Opcode Fuzzy Hash: 8afbc4274c9cc430fbc562d31bc3ac0af8895421c76893dc139c890ea3d92eb4
Instruction Fuzzy Hash: 38219CB1D056688BDB29DF6B8C04799FAF7ABC9300F04C1FA941DA6214DB3009858F54

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exe PID: 5612 Parent PID: 5480 RegAsm.exeCOMMON

Executed Functions

Function 05C0E770, Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b0ca37e34614e07a813f96303b0fd5874f02d208b61698756b4156b362d46ab
Instruction ID: 12710a556b504797c71665c69b62774fff8cbe1a39128387d919c2b2b06e4daa
Opcode Fuzzy Hash: 9b0ca37e34614e07a813f96303b0fd5874f02d208b61698756b4156b362d46ab
Instruction Fuzzy Hash: 0112CC70A44229CFCB28DF69D094A6DBBFBFF89301F148D29D4129B394DB389941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05C071D8, Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07393fb5181fad9b596ec79acaf524ddda2a517fba9fed8cb00e215270edb69
Instruction ID: c72b499ee4ca8e82c13f10d5cdc6066a707546a71d6b3b33312214ab9b377c2f
Opcode Fuzzy Hash: b07393fb5181fad9b596ec79acaf524ddda2a517fba9fed8cb00e215270edb69
Instruction Fuzzy Hash: 8812BC70A14615CFDB1CDB65D494A7DBBF2FF88301F25992AE012AB394D738A981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 065C1800, Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509106767.00000000065C0000.00000040.00000001.sdmp, Offset: 065B0000, based on PE: true

Associated: 0000000C.00000002.509088108.00000000065B0000.00000004.00000001.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2967b3d003e5307e1e774965ce26c35052d2a320365a9f2fcd0a9651a4f4423
Instruction ID: c81063414a64ed40e8cf4cfee5c48039ad34ec1f9fdb1f4b975d0cb7f9610bae
Opcode Fuzzy Hash: d2967b3d003e5307e1e774965ce26c35052d2a320365a9f2fcd0a9651a4f4423
Instruction Fuzzy Hash: 6612B030A14A15CFEBA4CFA4C0416ADBBF2BF89315F54892DE0069B396CB34D985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06AA0F70, Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b4ba8cbd63644c0bd45a55dff92efe40aca895e79c81b1cc9ce3cd6b4ae242
Instruction ID: a1c00f499b08ecd29d2f4b4992ca5682c51e1ccccec92e78c6af10e46f35e40a
Opcode Fuzzy Hash: 17b4ba8cbd63644c0bd45a55dff92efe40aca895e79c81b1cc9ce3cd6b4ae242
Instruction Fuzzy Hash: D1819034B142189FDB48AFB5A8542BE7AB3BFC9604F05886ED506E7388DF38DC058795

Uniqueness

Uniqueness Score: -1.00%

Function 05C08048, Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b464bd8503151d132edf980b36fef59d6bbcdc2d5b0766078ab22c3781282c
Instruction ID: 2828146871bdab9fe0af85f475bd4898b002c9418b24886f625552b1a6263731
Opcode Fuzzy Hash: a0b464bd8503151d132edf980b36fef59d6bbcdc2d5b0766078ab22c3781282c
Instruction Fuzzy Hash: 0E918D31B051158FD714DB69C980AAEB7E3AFD8314F2AC968E406EB795DB31DD01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05C0F388, Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c74dc1430928a401c7f35ce9871a9260d02f54ea69452a00c73df9a860efa4
Instruction ID: 1d641aad9ac1e99ced9640d8b2bd177febf3d151d0ee06617296796851f694a6
Opcode Fuzzy Hash: d9c74dc1430928a401c7f35ce9871a9260d02f54ea69452a00c73df9a860efa4
Instruction Fuzzy Hash: 87918E31F051158FD724DB69C980AAEB7E3AFC8314F2A8968E505EB7A5DB30DD41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05C0A2A0, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce9869c95ca5cdb176d872f9cf5779426604633063fa85718a0e7bcb3d5e8a3
Instruction ID: d97acf395ae7cfaa809baf1e1f1132f5533fd0c9d08b652e6a9bdb4405b23ca5
Opcode Fuzzy Hash: 8ce9869c95ca5cdb176d872f9cf5779426604633063fa85718a0e7bcb3d5e8a3
Instruction Fuzzy Hash: B951E478D01208DFDB04DFA4E995AADBBB2FB49301F108529EA01B7394DB785A45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05C0A2B0, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 297cbe5f580a0142f2f10b75e5895e05f02fe9cac516c6e41e53b0e3a35cd3ce
Instruction ID: b05f418e42244d72b2e8460e71a26e17401ef0ce9a3b39743054276f5785807f
Opcode Fuzzy Hash: 297cbe5f580a0142f2f10b75e5895e05f02fe9cac516c6e41e53b0e3a35cd3ce
Instruction Fuzzy Hash: 6B41F278D01208DFDB04EFA8E995AADBBB2FB49301F108129EA01B7394DB745A45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05C0A439, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa33c7ac3bac5fc3697d9c1918c876bd3431079322fa6510f13840184adaa4e
Instruction ID: 34a6fa3f53300e6126e2d3641d2cfb10aeded1fd8884486c4ba7716d86bb66a7
Opcode Fuzzy Hash: 8fa33c7ac3bac5fc3697d9c1918c876bd3431079322fa6510f13840184adaa4e
Instruction Fuzzy Hash: 8121CF35B142489FCB15CBA5EC59ABEBBB6EFCA210F149436E506D3385CB389C428B50

Uniqueness

Uniqueness Score: -1.00%

Function 05C08388, Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

hQ`, xrefs: 05C083F8
, xrefs: 05C084AA

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID: $hQ`
API String ID: 0-157799972
Opcode ID: 613ef2508565849ccf16a4fb7033d7d7084190ad8bc115cc9f7d74df6e8a0c5e
Instruction ID: cf29c8acfa03469c03f159b93a30975f10b5e23a7de6f18b822da98d8792ae43
Opcode Fuzzy Hash: 613ef2508565849ccf16a4fb7033d7d7084190ad8bc115cc9f7d74df6e8a0c5e
Instruction Fuzzy Hash: 5451F232B041148FCB94DBB9D89456EB7A3FBC8214B15C97AD60ADB392DB30DD42C791

Uniqueness

Uniqueness Score: -1.00%

Function 05C07DF0, Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

hQ`, xrefs: 05C07E8E
, xrefs: 05C07F10

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID: $hQ`
API String ID: 0-157799972
Opcode ID: d013cfd038f397eae24a64d1f21225f5fd2533e9221e2ba4b95996a0fffcedba
Instruction ID: 64210efa5b1c515249db41231ddf9cae14d6eac40841b558876f7fdf423aa2e9
Opcode Fuzzy Hash: d013cfd038f397eae24a64d1f21225f5fd2533e9221e2ba4b95996a0fffcedba
Instruction Fuzzy Hash: 0941ED32F051198FCB18DB5AC8805AEB7A3FBC4224B28D87AD5259B781D731AD538B91

Uniqueness

Uniqueness Score: -1.00%

Function 04C193E8, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 04C1962E

Memory Dump Source

Source File: 0000000C.00000002.506502448.0000000004C10000.00000040.00000001.sdmp, Offset: 04C10000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 91c39aab48d1b29367e47aa48743ccea8662872b80105c041e604897e1f05fd5
Instruction ID: 08b644a5ac7e83973900a10449be9f2153a4c42d4dc63afbdd5a0742c3672efd
Opcode Fuzzy Hash: 91c39aab48d1b29367e47aa48743ccea8662872b80105c041e604897e1f05fd5
Instruction Fuzzy Hash: B77116B0A00B058FD724DF2AD45175ABBF2BF89314F008A2ED48AD7A50D734F945DB91

Uniqueness

Uniqueness Score: -1.00%

Function 04C1FB4F, Relevance: 1.6, APIs: 1, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.506502448.0000000004C10000.00000040.00000001.sdmp, Offset: 04C10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5d238c0643e62ceefebcee33ec572929e2ebd7ec2ea6b66aad1a02ca1188ad5
Instruction ID: c4c4f929094a7aaa17dcee049270966a2d9e956840d875b785b0465677c2b200
Opcode Fuzzy Hash: b5d238c0643e62ceefebcee33ec572929e2ebd7ec2ea6b66aad1a02ca1188ad5
Instruction Fuzzy Hash: 235103B1D043489FDB14DFA9C880ADEBFB1FF49310F24812AE819AB221D774A946DF51

Uniqueness

Uniqueness Score: -1.00%

Function 04C1DA04, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04C1FD0A

Memory Dump Source

Source File: 0000000C.00000002.506502448.0000000004C10000.00000040.00000001.sdmp, Offset: 04C10000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2f82e5bded1d64f546716e88604c481a3fcccfa90e8bc581b4c3047a6f37f970
Instruction ID: 6c8f2e76a7cdfa67de9bd8762e81b9458053188dfa6bb3adf14037099049b353
Opcode Fuzzy Hash: 2f82e5bded1d64f546716e88604c481a3fcccfa90e8bc581b4c3047a6f37f970
Instruction Fuzzy Hash: A751B1B1D04309DFDB14CF99D884ADEBBB6FF49314F24812AE819AB210D774A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04C1A14C, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04C1BCC6,?,?,?,?,?), ref: 04C1BD87

Memory Dump Source

Source File: 0000000C.00000002.506502448.0000000004C10000.00000040.00000001.sdmp, Offset: 04C10000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: aa28c40868a249656859d4d8e936ebc39c80bd50239e9728cea8cb614ea23c75
Instruction ID: b98360c02719c701ea342fde7a183462baae0d8313599931e5f86e37036fa335
Opcode Fuzzy Hash: aa28c40868a249656859d4d8e936ebc39c80bd50239e9728cea8cb614ea23c75
Instruction Fuzzy Hash: 4D21E3B5904248AFDB10CF9AD984AEEBBF5FB48314F14841AE954A3310D374A954DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04C1BCF9, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04C1BCC6,?,?,?,?,?), ref: 04C1BD87

Memory Dump Source

Source File: 0000000C.00000002.506502448.0000000004C10000.00000040.00000001.sdmp, Offset: 04C10000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 58395c1447a97e9d0be3bddb07b9b852de49d3759ef0503d25a011442f559df1
Instruction ID: f9481c555a0eada0d285f5d46a23b78c70e213b58de1154ce17fa4936237c482
Opcode Fuzzy Hash: 58395c1447a97e9d0be3bddb07b9b852de49d3759ef0503d25a011442f559df1
Instruction Fuzzy Hash: B6210EB5D00208DFCB00CF99E580ADEBBF5FB48320F14802AE958A3310D378AA54CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04C18768, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,04C196A9,00000800,00000000,00000000), ref: 04C198BA

Memory Dump Source

Source File: 0000000C.00000002.506502448.0000000004C10000.00000040.00000001.sdmp, Offset: 04C10000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 23f89ae88f321c1da014b5accb2b6e90468dbf6767de55406a170b016d8bc188
Instruction ID: 475530900ad58f2040b6f8dd8282bf7b9f45c2923a91d907ee94f9a62fb94002
Opcode Fuzzy Hash: 23f89ae88f321c1da014b5accb2b6e90468dbf6767de55406a170b016d8bc188
Instruction Fuzzy Hash: 921130B2D042088FEB10CF9AC444BDEFBF5EB89314F04842EE919A7210C374A949CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05C04888, Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

@ [l, xrefs: 05C04B99

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID: @ [l
API String ID: 0-2673240109
Opcode ID: c9be08a6a227a32ecf6e2cc1545e8ba7644d9c4826345df1db85103daa97de0c
Instruction ID: 857a659e4335b93fb5a518d9b9c0f3616e7afc8997ae01adc1f60fe00477551a
Opcode Fuzzy Hash: c9be08a6a227a32ecf6e2cc1545e8ba7644d9c4826345df1db85103daa97de0c
Instruction Fuzzy Hash: 05C1A030E04659CFCF08DFA8D5805AEF7B2BF85304B259A69D509AB345DB31ED86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04C19849, Relevance: 1.6, APIs: 1, Instructions: 50libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,04C196A9,00000800,00000000,00000000), ref: 04C198BA

Memory Dump Source

Source File: 0000000C.00000002.506502448.0000000004C10000.00000040.00000001.sdmp, Offset: 04C10000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9628191d04ab2da9574bca72292d0ede172c1bc60eaaf3e5eb9c25797fecad8f
Instruction ID: 6a05af5cac281a4e249c20f6d8df462c70f9e8b9a9ab5f832fd233ec6d521f14
Opcode Fuzzy Hash: 9628191d04ab2da9574bca72292d0ede172c1bc60eaaf3e5eb9c25797fecad8f
Instruction Fuzzy Hash: 62110DB6D042098FDB10CF99D544BDEFBF1BB88314F14882ED969A7210C374AA49CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04C195C8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 04C1962E

Memory Dump Source

Source File: 0000000C.00000002.506502448.0000000004C10000.00000040.00000001.sdmp, Offset: 04C10000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 68f6f5ffa3ac732a0386c54b1e9781369f8f03339b854612415ed7fa7d10e750
Instruction ID: 9a34433e4408d3c9ee5a4baa60da0a89bb65394269901749bce7335a4eb65484
Opcode Fuzzy Hash: 68f6f5ffa3ac732a0386c54b1e9781369f8f03339b854612415ed7fa7d10e750
Instruction Fuzzy Hash: B11122B1C006498FCB10CF9AD444BDEFBF5EF89314F10842AD859A7210D374A649CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04C1FE38, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,04C1FE28,?,?,?,?), ref: 04C1FE9D

Memory Dump Source

Source File: 0000000C.00000002.506502448.0000000004C10000.00000040.00000001.sdmp, Offset: 04C10000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: ffa90f5f0c366132496813c2b2cdcef5e490a10dbec17698489c4dbc14d142d9
Instruction ID: e862a29ce814d90dee778cac9e7c1eea415e8035d751416fd3d355ed6eb94b33
Opcode Fuzzy Hash: ffa90f5f0c366132496813c2b2cdcef5e490a10dbec17698489c4dbc14d142d9
Instruction Fuzzy Hash: 6011F2B58002598FDB20CF99D485BDEBBF4FB89324F10841AE958A7251D374AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04C1DA3C, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,04C1FE28,?,?,?,?), ref: 04C1FE9D

Memory Dump Source

Source File: 0000000C.00000002.506502448.0000000004C10000.00000040.00000001.sdmp, Offset: 04C10000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 86da3e0a5d295f0f2d0146d81a2b24bb978b1f2e5870160f500028edb45b2ea3
Instruction ID: 92e4da25444d8347c1f9314abd951e64617937ebc373b187778b6b5a8a3ada50
Opcode Fuzzy Hash: 86da3e0a5d295f0f2d0146d81a2b24bb978b1f2e5870160f500028edb45b2ea3
Instruction Fuzzy Hash: DE1133B18042488FDB10CF8AD484BDFBBF8FB88324F10841AE958A3300D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05C040D0, Relevance: 1.5, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

@ [l, xrefs: 05C040F2

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID: @ [l
API String ID: 0-2673240109
Opcode ID: 6559d65ea1d548786a5758a1bd438491ac8516a00829071e94a18c84e04c8ec7
Instruction ID: 9c6df2ac94d96882d4b9efa5e5038e0f6d45307bcab739059a21c52af88618a7
Opcode Fuzzy Hash: 6559d65ea1d548786a5758a1bd438491ac8516a00829071e94a18c84e04c8ec7
Instruction Fuzzy Hash: 3DC1A431E04659CBCF14EFA8C4905AEB7B2FF85304F119A59D559AB341EB30ED85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C0E4C0, Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

r*+, xrefs: 05C0E6C6

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID: r*+
API String ID: 0-3221063712
Opcode ID: 8214c6d4034a403fa1143e63dc8efe4c9ade01e637c7437729e2bdd224d0a2c7
Instruction ID: 809de9deb3bb01f53ea1b29852e0f68adc6af8e291a4cceb64cc80f724b31461
Opcode Fuzzy Hash: 8214c6d4034a403fa1143e63dc8efe4c9ade01e637c7437729e2bdd224d0a2c7
Instruction Fuzzy Hash: BA6119B8D4410E9FDF14CFAAE4449ADBBB2FB48314F10B965D502EB3A0EB3599418F10

Uniqueness

Uniqueness Score: -1.00%

Function 05C06F40, Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

r*+, xrefs: 05C0712C

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID: r*+
API String ID: 0-3221063712
Opcode ID: 31d9ba966cba59e3d6fa8c8f65779540179eac078ff3d11b3c7bd8facb528cd5
Instruction ID: 63e9123326ef488161572f1bf4707e0a67c76deae53d1ac84ae7481e3bdead60
Opcode Fuzzy Hash: 31d9ba966cba59e3d6fa8c8f65779540179eac078ff3d11b3c7bd8facb528cd5
Instruction Fuzzy Hash: 0E61DE78D0410ADFDF14DFAAD5849AEBBF1FB48314F10A965D506EB2A0DB35AA41CF10

Uniqueness

Uniqueness Score: -1.00%

Function 065C30C0, Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

, xrefs: 065C31E2

Memory Dump Source

Source File: 0000000C.00000002.509106767.00000000065C0000.00000040.00000001.sdmp, Offset: 065B0000, based on PE: true

Associated: 0000000C.00000002.509088108.00000000065B0000.00000004.00000001.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 7d73b18ab51db2620cec8faefd9459785174aa06d0358403c6eb6a8b0f76e35d
Instruction ID: 8bec42331039a37b1df9aeb8e6ae2037ddc41fb1282edde275947b010cc66941
Opcode Fuzzy Hash: 7d73b18ab51db2620cec8faefd9459785174aa06d0358403c6eb6a8b0f76e35d
Instruction Fuzzy Hash: 26410132F081199FDB949BEECC800AEB7A2FBC5264719C97ED116DB605C632ED0687D1

Uniqueness

Uniqueness Score: -1.00%

Function 05C045C0, Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

@ [l, xrefs: 05C046D8

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID: @ [l
API String ID: 0-2673240109
Opcode ID: ad8bf38b25bc63a05a79af057ce09c766f49a29f1b7ab9c757c20c6fd09dc439
Instruction ID: 53d1a4040ed575d8c61bc5223f86c6755bd2b0ff3ba46b9b4e6eb101af61ec75
Opcode Fuzzy Hash: ad8bf38b25bc63a05a79af057ce09c766f49a29f1b7ab9c757c20c6fd09dc439
Instruction Fuzzy Hash: FE510631A046149FCF04EBA9D4848AAF7B2FF85310711DA6AD659AB291EF30FD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05C0F130, Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

, xrefs: 05C0F250

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: bc21bdfcd118d9e93e8f4e3397d8bed4c5b41143c064ed797a28bafb8ddbc53c
Instruction ID: 3b2464bd47580db8cc6a87e55221dd2ddce8e7b78a6138cde8cf00d5bde2f737
Opcode Fuzzy Hash: bc21bdfcd118d9e93e8f4e3397d8bed4c5b41143c064ed797a28bafb8ddbc53c
Instruction Fuzzy Hash: C1410431F081198FCB20CF9ADC804AEB763FBD5324B29897AD5159B681C3319A97CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C040C1, Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

@ [l, xrefs: 05C040F2

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID: @ [l
API String ID: 0-2673240109
Opcode ID: 306aaf10be6bca5065e6dc05c0c5d8ee5b27e6345a4b099acd46aa034affeb69
Instruction ID: cae4646981cf5b0f0f8b3e7cb6a0f9110bf43d51ae07cd0ec4f6d3b6d4882043
Opcode Fuzzy Hash: 306aaf10be6bca5065e6dc05c0c5d8ee5b27e6345a4b099acd46aa034affeb69
Instruction Fuzzy Hash: 38516130904259CFDF18DF69C980AAEBBB2FF85304F119999D549AB341EB70E985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05C058E1, Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

C$, xrefs: 05C05924

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID: C$
API String ID: 0-57044107
Opcode ID: c6200d6da2106d7e1a635316d200aa41e926d76d58df6d600891b56505cd2cfb
Instruction ID: 76597fddbdde1fd63826a9ae19f9499940e21187badb4aa3de41cb896e927a41
Opcode Fuzzy Hash: c6200d6da2106d7e1a635316d200aa41e926d76d58df6d600891b56505cd2cfb
Instruction Fuzzy Hash: 3C21F0316182188FDB249BB8E41016973A3FFC16147164E2ED14AC7790EF38AC56CF80

Uniqueness

Uniqueness Score: -1.00%

Function 05C04690, Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

@ [l, xrefs: 05C046D8

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID: @ [l
API String ID: 0-2673240109
Opcode ID: 0fe8feafab7ae00bba04de29ea0ea38e21751e6dace4d067934a8bc747ea7167
Instruction ID: d8664a5f9c720e4462080725e13b4a08bebb5cf2015916714dbd93decef846ef
Opcode Fuzzy Hash: 0fe8feafab7ae00bba04de29ea0ea38e21751e6dace4d067934a8bc747ea7167
Instruction Fuzzy Hash: EB11E930E151149FCF48EBA9E4845AFBBB3FB44214B108529EA05A7391EF309D05C791

Uniqueness

Uniqueness Score: -1.00%

Function 05C058F0, Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

C$, xrefs: 05C05924

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID: C$
API String ID: 0-57044107
Opcode ID: 8a6abac7f7ca0759c0e58af4e1f4affc62c3a71fdd3226e9d58373a7f90cd2a6
Instruction ID: a083f62beab01b5b80ab97126555675ef0f077b7c6d0dd0d2607c2f26e68ffde
Opcode Fuzzy Hash: 8a6abac7f7ca0759c0e58af4e1f4affc62c3a71fdd3226e9d58373a7f90cd2a6
Instruction Fuzzy Hash: C0F028316182198BC7209779980011DB7A3FFC2A283064E3DD10AD7380DF30AC568FD0

Uniqueness

Uniqueness Score: -1.00%

Function 06AA1550, Relevance: 1.2, Instructions: 1173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df303f3843fda49907238ed735279848e0ed3cf2e12b8bc3c5dad480cb88fdc5
Instruction ID: 5705baa90fd3e672d5b25b1ae872b6e64aef727dabede7a85ea782234182b0fb
Opcode Fuzzy Hash: df303f3843fda49907238ed735279848e0ed3cf2e12b8bc3c5dad480cb88fdc5
Instruction Fuzzy Hash: 9E510134A0C381FFD795BB25941457E7BB7AB86255F0844ABE107CB342DB259C0AC7E2

Uniqueness

Uniqueness Score: -1.00%

Function 05C02E10, Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4212e78fcad9cb9b10de9db2c15df2300036c66ac2e577ef35366a6cbac09f7
Instruction ID: 4452fa7f47a1684b5b3afa7fd664fa401ca812a92dc4be4f466b48dfb9e879fb
Opcode Fuzzy Hash: e4212e78fcad9cb9b10de9db2c15df2300036c66ac2e577ef35366a6cbac09f7
Instruction Fuzzy Hash: EA323B78A18610CFCB14DF29C585A69B7F2FF88715B169899E9469B3B5CB30ED80CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C03A60, Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 770b78d5abc6bb729f00833ba4d662c3069c3b06569d69256134d669237d414c
Instruction ID: 4a2e0a9f2fa8d0b842945d98c8ff3b579b2be29ef8afcb8a8050f0e7b9a1fe47
Opcode Fuzzy Hash: 770b78d5abc6bb729f00833ba4d662c3069c3b06569d69256134d669237d414c
Instruction Fuzzy Hash: 7A718B30B046558FCB14EBA9C88497BB7F2FF88A04B148D2DD55797794CB31E942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C05168, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 426aeb873816d99d53a6a1e77734c91087e45290e680584ed64398bf14a515df
Instruction ID: 52e31dfda278d6994728e537615efed7960c002cd561a8460b7c66b7247d9a8e
Opcode Fuzzy Hash: 426aeb873816d99d53a6a1e77734c91087e45290e680584ed64398bf14a515df
Instruction Fuzzy Hash: 2271E070A082019FDB28DB69D484A7EB7F2FF84310F15A95AE406DB2E2D774E941CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05C02778, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc23ae9e865eabc07022b531859277aef5593b75b27bec340796d1329c48eae8
Instruction ID: 299d5de4abd3f8f0db0ccd9b3e57049d3b47de55025c2d925b62979ccd9c13cd
Opcode Fuzzy Hash: cc23ae9e865eabc07022b531859277aef5593b75b27bec340796d1329c48eae8
Instruction Fuzzy Hash: FC716F39A04604CFDB28CF65C598BAAB7F2FF88314F549A59D446A7390DB31EE41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C00040, Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f77212348362b4b3ab1b2e9630cefecf3225860fcddba4447042cdf69c3ebc0
Instruction ID: 5e026ba29d096ee0c9b7b8fadaf4990357aba2ad9cb3ebddf7422518cdd47cfd
Opcode Fuzzy Hash: 3f77212348362b4b3ab1b2e9630cefecf3225860fcddba4447042cdf69c3ebc0
Instruction Fuzzy Hash: F6719871E042289FDB14CF99C888BDEBBB1BF48304F56852AD819BB390D774A944CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05C079E8, Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04d79f4f3758f61e9204db7637cef9588b4a6697d6b1fd0b4f308ab45a749567
Instruction ID: 24a1948188614a4001247adce7e1ddcfba1416e0f7a032f674c8c84bde40cf5f
Opcode Fuzzy Hash: 04d79f4f3758f61e9204db7637cef9588b4a6697d6b1fd0b4f308ab45a749567
Instruction Fuzzy Hash: 2851D130A08225DFCB1DEB65D4109BEB7F2EB84200F15BD6AD1069B6C1EB30BA54C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05C02DFF, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aa92f0f2f042ac6c36d475ffd485e3e2c56f725e1246674d635f93ee359d997
Instruction ID: 46f165e08186d3ed395946f57a1036b02e89a1623f34e512083c666e720623bb
Opcode Fuzzy Hash: 8aa92f0f2f042ac6c36d475ffd485e3e2c56f725e1246674d635f93ee359d997
Instruction Fuzzy Hash: FF812678A04614DFDB14DF69D589EA8BBF2FF49711F118099E90A9B3A1DB30AD80CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C03DD8, Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2c62bfbe217aa5f31c7181a79fdce94eae1e6de6272bc9622d009dac5177837
Instruction ID: ce5dbf0c70b6363b185e53022e7b0eea8b15d8bbff8578a5e749c1002672cca7
Opcode Fuzzy Hash: b2c62bfbe217aa5f31c7181a79fdce94eae1e6de6272bc9622d009dac5177837
Instruction Fuzzy Hash: 76511931A08284DFC715E77AD8446BAFBA6FF85A01F008E7BE029C7281D735D981C791

Uniqueness

Uniqueness Score: -1.00%

Function 05C05753, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88bd861f1402a250c2c1043c25ef3e05e18b073e36122b3f1c6e9da06441f86a
Instruction ID: 769565f64228c226d3e1199a7d878d27fed4c2f25a63529e2ea4e12692ad88b9
Opcode Fuzzy Hash: 88bd861f1402a250c2c1043c25ef3e05e18b073e36122b3f1c6e9da06441f86a
Instruction Fuzzy Hash: FB41063151D394CFD7129B79A8A05B93BB2EF426047064DABC542CF292EB389D05CF92

Uniqueness

Uniqueness Score: -1.00%

Function 05C033C4, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54fb8916e1c4fe641e40316fa3d144d7a1b12c785b931c25de68d35df4b599b8
Instruction ID: a80295faca4f68de5e9f4b718f2412f5994188e43d9f46d0ae6cd69be610d345
Opcode Fuzzy Hash: 54fb8916e1c4fe641e40316fa3d144d7a1b12c785b931c25de68d35df4b599b8
Instruction Fuzzy Hash: DC51FE38A04600DFD754DF69C999E69BBB2FF48B01F229498E9069B3A5CB30EC40CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C034EE, Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a28ecbeb92d931726d0cf045e13f338daf7dfe5fad5609eaf5253950ef6cb3
Instruction ID: a92d85a129e659e3b38ac2cd3580611cb386210a73144ef869ecf54b5ae0b6d6
Opcode Fuzzy Hash: d2a28ecbeb92d931726d0cf045e13f338daf7dfe5fad5609eaf5253950ef6cb3
Instruction Fuzzy Hash: 7D51CC38A40604DFD714DF68D588E58B7B2FF48716F229098E9069B3A5CB31ED80CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C0E4A6, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3c39b1e64211c51aafe2baa32480ea951d3dab2074640e3dea6affaf8b6b67
Instruction ID: cce8fbb25a8df88ebaeea0e186d6e21443ae3df92d81fc1c096f17ac9d25b7aa
Opcode Fuzzy Hash: dd3c39b1e64211c51aafe2baa32480ea951d3dab2074640e3dea6affaf8b6b67
Instruction Fuzzy Hash: 2041387894420ADFDF14CFA9E4849ADBBB2FB49314F10AD69D502EB390DB359A41CB11

Uniqueness

Uniqueness Score: -1.00%

Function 05C06F30, Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d9167f83d2690bfc0f7bfcb27f234afb5ab11bdb030401f16e43cca7928165
Instruction ID: b153b039df4c541ade2b56c01740a91801d95440bd1cbee09b7411b9ea77d8a1
Opcode Fuzzy Hash: b0d9167f83d2690bfc0f7bfcb27f234afb5ab11bdb030401f16e43cca7928165
Instruction Fuzzy Hash: 40414EB9D00109DFDF14DFA5D485AAEBBF2FB48314F10A965D502EB390DB36AA41CB10

Uniqueness

Uniqueness Score: -1.00%

Function 05C000DC, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8aa0cd34f8d71890adcdbf431ab6ac68d1883db535dc43510a251ae9885423e
Instruction ID: de478eaf66c574762c773dba5cb525654c2009bd4ec2ba00cb6a238925ea70a2
Opcode Fuzzy Hash: d8aa0cd34f8d71890adcdbf431ab6ac68d1883db535dc43510a251ae9885423e
Instruction Fuzzy Hash: 13512570D042188FDB14CFA9C889BDDBBB1BF48304F55852AE816BB390DB74A945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05C03443, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7f014afcef80f58acfeed7e7fa3f8815dbf0180be2f2c0270ae5aaab69ab34f
Instruction ID: 1c0fd67450747e761874b1720961dab99593dd9a089850ddbb18c9d3942be1ad
Opcode Fuzzy Hash: f7f014afcef80f58acfeed7e7fa3f8815dbf0180be2f2c0270ae5aaab69ab34f
Instruction Fuzzy Hash: F951E138A41604DFDB10DF68D999E68B7B1FF48715F219498E906AB3A1DB31ED80CF00

Uniqueness

Uniqueness Score: -1.00%

Function 05C0349E, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9873f9e99b86f7fa140aa7c3483d58123ddee092509bfe9a57395abd706206
Instruction ID: 2b3332217a8aec8688cfecb68449aee6f8893133e5eff8a8e544e690584e209e
Opcode Fuzzy Hash: 3e9873f9e99b86f7fa140aa7c3483d58123ddee092509bfe9a57395abd706206
Instruction Fuzzy Hash: EF51DF38A41604DFD714DF68D599E58B7B2FF48716F229498E9069B3B5CB31AD80CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C02767, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b5cc51aa886a1f783bb56a2be31a86c8b7036c6f52931fd339b20873669dbd1
Instruction ID: b6c5009d00b9c75f40bfa4b2538882b349806ff18313b47d0fd5e34503c75e1a
Opcode Fuzzy Hash: 0b5cc51aa886a1f783bb56a2be31a86c8b7036c6f52931fd339b20873669dbd1
Instruction Fuzzy Hash: 75519439A04604CFDB28CF65C488BAAB7F2FF48314F549A69D556973E0CB31AD85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05C03567, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78382ef5153b65bccb4c04bfdd45723db4eaf9840e19357722a7d3c8d5a6fc21
Instruction ID: 87c2e58944006747dee2f0ce30f5f04cb83c026d9d7336eaa9d80b57842e588f
Opcode Fuzzy Hash: 78382ef5153b65bccb4c04bfdd45723db4eaf9840e19357722a7d3c8d5a6fc21
Instruction Fuzzy Hash: 9151CD38A41200DFE754DF28D599E69B7B2BF48716F229498E9069B3B5CB35ED40CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C038A0, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975add0c7de6e0d0a57724ef6910ebb76a942606564e07d57d4421da010a7a6e
Instruction ID: 0cb189169bfe73fbafbd5c4bb750d858d81514ecd898da368dd618107eec4778
Opcode Fuzzy Hash: 975add0c7de6e0d0a57724ef6910ebb76a942606564e07d57d4421da010a7a6e
Instruction Fuzzy Hash: 9B412935A04144DFCB04DBA9C480EEDBBF2BF88724F169995E901AB3A5DB31ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 065C3BC8, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509106767.00000000065C0000.00000040.00000001.sdmp, Offset: 065B0000, based on PE: true

Associated: 0000000C.00000002.509088108.00000000065B0000.00000004.00000001.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96370a57765732a6757487da511ed3e279eb66f41cdc03efc136e1738d6d59f1
Instruction ID: 3fa6014783f06aec1f5c80eb5ac40f17b2b38f6acbf6467008875f64b4e8bc7b
Opcode Fuzzy Hash: 96370a57765732a6757487da511ed3e279eb66f41cdc03efc136e1738d6d59f1
Instruction Fuzzy Hash: CC413B30F046299FDB98AFB5D45466EBBF6BB88260F10C82DE406AB351DA7588418B90

Uniqueness

Uniqueness Score: -1.00%

Function 05C02089, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9eec82186107b3b01384f21864e0516e89c927430c0aa1d225dc090abc9bb5b
Instruction ID: 040927d21e54bc5a39340339aa5f39476f56e2d5c6c9e59e6a27e9b530420220
Opcode Fuzzy Hash: a9eec82186107b3b01384f21864e0516e89c927430c0aa1d225dc090abc9bb5b
Instruction Fuzzy Hash: 3431D1312193504FC710EB34958176EBBA3AFC2208B49892DD1469F382EF79FE49C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05C0BCC1, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc777ba360cb2d552e7b28f706a64ebb35e90d675618e7e1f5fd13cc98383f55
Instruction ID: 5b3101aff232db8eeec92c90cbe3bd08f2143e53ea056708b7e1aaf87997e1da
Opcode Fuzzy Hash: bc777ba360cb2d552e7b28f706a64ebb35e90d675618e7e1f5fd13cc98383f55
Instruction Fuzzy Hash: D231F53240E3555BC302EF78E9A5BCABF729F12218F0A4A96D140CB691D628DB889756

Uniqueness

Uniqueness Score: -1.00%

Function 05C07CB8, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec8a62746c93eaa264a9fb43ad5723775f686535d376b5b3412f899a5921553
Instruction ID: 5043fc9cf276abde99ab5ca5bf129df69be95a7b269fd1d3e452762c806c19a6
Opcode Fuzzy Hash: fec8a62746c93eaa264a9fb43ad5723775f686535d376b5b3412f899a5921553
Instruction Fuzzy Hash: 9A3153317082909FCB19DB79D954C7C7BE2FF462247154AAAE50ADB3E2CB24AD01C392

Uniqueness

Uniqueness Score: -1.00%

Function 05C020D2, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd16ee165539d93a03e6d0cd31be11fd56d1cc624abb93c4e0c42cc423add82
Instruction ID: 329042d6db15629c56a0207e55d17c2618616c10e0af60ba8f808abf3a7b1dee
Opcode Fuzzy Hash: 1bd16ee165539d93a03e6d0cd31be11fd56d1cc624abb93c4e0c42cc423add82
Instruction Fuzzy Hash: BD31C4313193504FC700EB34919126EB7A3AFC2218759892DC1469F382EFB9FE5987A1

Uniqueness

Uniqueness Score: -1.00%

Function 05C007F0, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a7d2d88c467c5efc9cbe24cd5df8069d7651c8232e1be0397b33a69b6b1b2af
Instruction ID: 2db0ec42cfaee8161e00ce74f9f03b8a48573f725c57acdb3759bee9c5ea1e88
Opcode Fuzzy Hash: 8a7d2d88c467c5efc9cbe24cd5df8069d7651c8232e1be0397b33a69b6b1b2af
Instruction Fuzzy Hash: 3A317AB0E10218CFEB14DF69C448BADBBF6BF48714F158429E406B7390CB74A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C06C75, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b06498a5bc7f4612769786c647f7ceeef15e89a78f4074b9e86fa5115e5340a
Instruction ID: 8cbbe06a0621e81ffdde6369093a80379f09c3fe1d36d84c45d267750d136084
Opcode Fuzzy Hash: 8b06498a5bc7f4612769786c647f7ceeef15e89a78f4074b9e86fa5115e5340a
Instruction Fuzzy Hash: 23414AB42447208FC325EF38E14441A77F2EB8520A3418E2DD15AEB794DF79AD86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05C00358, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa5925c0ad9efc4f414aa58e35c9548defba544566917c928aa4694fb5dbc599
Instruction ID: 1eccdce3d3ba92086eed92739643191b4be190e049bbd3636191fa950e983514
Opcode Fuzzy Hash: aa5925c0ad9efc4f414aa58e35c9548defba544566917c928aa4694fb5dbc599
Instruction Fuzzy Hash: F221B4317102108FC705DB69D884A69B7B6FF89324B128569E519DB3A2CB71EC06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C02B58, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 282062dd962e8f39e9bcf263e7cd2d688852f11f122cb2dde11c10ab9ff396b1
Instruction ID: 4e790539f8b2d897029136c57863812c15ecfeb6a579ed53735d58fbb466e726
Opcode Fuzzy Hash: 282062dd962e8f39e9bcf263e7cd2d688852f11f122cb2dde11c10ab9ff396b1
Instruction Fuzzy Hash: 9D31AF36D106198BDB11FBB8D8181EDB7B2FF94324B059A25D44A77380EF34B99587C1

Uniqueness

Uniqueness Score: -1.00%

Function 05C02555, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6eb55dae0bda939a6f580b6f6f664c0c3943239bbf665eac6321c7667710ba6
Instruction ID: 1349c8ab20463edfaa8d048f8278a4387abb46f49ec80e9a841e41658305dcc0
Opcode Fuzzy Hash: e6eb55dae0bda939a6f580b6f6f664c0c3943239bbf665eac6321c7667710ba6
Instruction Fuzzy Hash: 0B3114B0D042589FCB14CFA9D584ADEBFF1BF58304F14842AE819AB390DB749A45DF90

Uniqueness

Uniqueness Score: -1.00%

Function 05C03A53, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50eae73019ff63878a5b7a5e7164dd60a985423e7b857df51949fe9308498087
Instruction ID: 15a1f67359f7a9859886c5a9c40a4cab2fc08deb300baa6fc88f38e20bdbc754
Opcode Fuzzy Hash: 50eae73019ff63878a5b7a5e7164dd60a985423e7b857df51949fe9308498087
Instruction Fuzzy Hash: 89319C30604695DFCB21DBAAC884A7BBBF2FF84A14F148E5AE553876D0C731A841CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C015E8, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5852f1182dd2f82908550f970f34bd536b475db58c382a6c5870be4081e6b5c
Instruction ID: 2d6810bdfd1f9f7c281c32bd6df83c82cc418c1e39fc08faab94729cdafe9ac2
Opcode Fuzzy Hash: c5852f1182dd2f82908550f970f34bd536b475db58c382a6c5870be4081e6b5c
Instruction Fuzzy Hash: 91314A30A042109FCB26AF76EC282ADB6E6EB84305F488869D016D7391DF389E41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05C02241, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b8db387c7723dac87f5f18038d7d9f78f8c3e7ac70d038fd46a7b63a7510efe
Instruction ID: 9426b3705a60bfb019729b0da8c8b8c2db0da40c2e4a862a2590dd886c1fc5b6
Opcode Fuzzy Hash: 5b8db387c7723dac87f5f18038d7d9f78f8c3e7ac70d038fd46a7b63a7510efe
Instruction Fuzzy Hash: 7431AB346042149FCB60DB75C544AAAB7E6FF89350B50993EE502DB790EB35ED41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05C02250, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418c913234aefdab172dceb09ad8dda0b0f2eb20492a8832a1475d44a1fd91ce
Instruction ID: afbcd871f7a215c71841a0626a949a55bf3a58c046fce9b52609644f8b200008
Opcode Fuzzy Hash: 418c913234aefdab172dceb09ad8dda0b0f2eb20492a8832a1475d44a1fd91ce
Instruction Fuzzy Hash: BC3198346043108FCB60DBB5C544A6EB7E6EF89310B50993ED402DB790EB36ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C02560, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 329e4a9620a1795565d8761cab06ef63b58a73fec96ccc3664960c17d6c07208
Instruction ID: 1f8c26e4f0d1ccf9cac7300e971d7e74b69d9070ba8e0c8ed46bb4bf5e907ebf
Opcode Fuzzy Hash: 329e4a9620a1795565d8761cab06ef63b58a73fec96ccc3664960c17d6c07208
Instruction Fuzzy Hash: C73115B0D04258DFCB14CFA9D584ADEBFF5BF58304F14842AE819AB390DB749945DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05C01F58, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef58d229041f86f8ffc64adb4adb3745d0be0044c3b073b592e3d38a6e1f64d
Instruction ID: 32848d4542081f2b01102da4472b009905af0b7c936a3ff7cfa459990fb429a8
Opcode Fuzzy Hash: 7ef58d229041f86f8ffc64adb4adb3745d0be0044c3b073b592e3d38a6e1f64d
Instruction Fuzzy Hash: E921D035A042248BCB15DB69D4047FEF7E3FB88315F04593AE0069B790CB799D44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05C015F8, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccfd7040ab6351a86e0aab20d869adc4b76452ddb40b24e9b7032b8aa8362fc0
Instruction ID: 5760f29bad4b5e61fa7f7fd9c86c2aa582705e8ca14a0abd6efb2afc4f13ec2a
Opcode Fuzzy Hash: ccfd7040ab6351a86e0aab20d869adc4b76452ddb40b24e9b7032b8aa8362fc0
Instruction Fuzzy Hash: 81215A30B042109FC725AF76EC282AEBAE6EB85305B488869D016D3381DF39DE41CF56

Uniqueness

Uniqueness Score: -1.00%

Function 05C0E383, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c242038a876a639a2db370dc348371ee958ce7fb538bf72015e44a21f21c43e
Instruction ID: dead0100e4770bcc7278490f892136a3b23d7ef851fc3f610c7eedb5965eba40
Opcode Fuzzy Hash: 6c242038a876a639a2db370dc348371ee958ce7fb538bf72015e44a21f21c43e
Instruction Fuzzy Hash: EB21D3223091544BDB2467BCA62136FE2DBCFC6248F09CA3DD10BD7781CE68AC4543B6

Uniqueness

Uniqueness Score: -1.00%

Function 05C02CF8, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d5e0a4774c61d6b91fba409a776b2444043ea106cd4e313136a51562b29c45
Instruction ID: a30b6b868c752bede289868f59fc5e7868a2710667c0af926902dd9086e62a18
Opcode Fuzzy Hash: 37d5e0a4774c61d6b91fba409a776b2444043ea106cd4e313136a51562b29c45
Instruction Fuzzy Hash: 51316F31E043099FCB15EFB9C8546EEF7F6EF89300F11862AD509A7240DB35A985CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05C0F2C0, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bef98484a3f8b685519c62126ef1ecf0a2efa378491b42c6549bb822f505453
Instruction ID: 5d72badb6f826467153f85eb9c55c16347fa2920d4637b2ccbeed83e7b775fd5
Opcode Fuzzy Hash: 6bef98484a3f8b685519c62126ef1ecf0a2efa378491b42c6549bb822f505453
Instruction Fuzzy Hash: 0121AF713184208F9774DB7AD44093973E6FF88A64315A8BEE50BCB7B0DB20DD808791

Uniqueness

Uniqueness Score: -1.00%

Function 05C07F80, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf619f44db8ddfa16319736e29164a527536869d027ea203dd972c54083368f
Instruction ID: b0db71283e172da01dd51f129bcc07fe21c2943947f29604ac781fab1dda6ad4
Opcode Fuzzy Hash: 9cf619f44db8ddfa16319736e29164a527536869d027ea203dd972c54083368f
Instruction Fuzzy Hash: 7C21B4753080108F8758DB7ED944D39B3E6EF8865470198BAF50BCB7B1DB20EC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 05C02B57, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69947da81494c2999a7bdd2224482e53b7fa1e132011f7dcd12d2905531bae78
Instruction ID: ecf866d8377587c01de535cc588aaa2fb4040d96b96ff63c84590f9c7fb7d128
Opcode Fuzzy Hash: 69947da81494c2999a7bdd2224482e53b7fa1e132011f7dcd12d2905531bae78
Instruction Fuzzy Hash: 8B21F331D10619CBDB10FBB8C8181EDB7B2FF94314B019A65D44A77380EF74A99A87C1

Uniqueness

Uniqueness Score: -1.00%

Function 05C07400, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 647f7f63f7310d4373e0eb03695b0b51f78542165d321efe194fb04735dd6c8c
Instruction ID: 3f7f87f7971d1316a75a087bd4d7501621cd968b498a731f062e254cbdb77d0d
Opcode Fuzzy Hash: 647f7f63f7310d4373e0eb03695b0b51f78542165d321efe194fb04735dd6c8c
Instruction Fuzzy Hash: EC312A30A10608CFCB68DF64D559AADBBF2FF45314F25E52AC016AB3A4C778A985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 05C0E998, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9928432b234101cdfb9954851a67ce5b531bd68340b9e4708bc68de18a1cfb16
Instruction ID: ecf158f5e508990b8e9eb52721853e48e617d2eef3b599913865be174ece3c0d
Opcode Fuzzy Hash: 9928432b234101cdfb9954851a67ce5b531bd68340b9e4708bc68de18a1cfb16
Instruction Fuzzy Hash: F8316830A50218CFCB24CF65D169A9EBBF2FF49314F15D929C415AB3A4DB789998CF01

Uniqueness

Uniqueness Score: -1.00%

Function 05C007E0, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c09ca74b626f2932a95ad99d5473478a0824d98c8389474312036c305a031e38
Instruction ID: b455e02c4b6b3d3814479d2e115c8c1b1eb121754b81bc15c5cac2dcf7a6e022
Opcode Fuzzy Hash: c09ca74b626f2932a95ad99d5473478a0824d98c8389474312036c305a031e38
Instruction Fuzzy Hash: 76317A70E142189FDB10DFA8D488BADBBF5FB08714F15842AE806B7390CB74A949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05C02D08, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a191d8ad1904351433e454705a1f893be6a34770c31348f3aa77f2fa421c5bb6
Instruction ID: 489a527caff2b0a7d207ec053fc11eda863cd6ba320e4f5f9fd27ac721deb79a
Opcode Fuzzy Hash: a191d8ad1904351433e454705a1f893be6a34770c31348f3aa77f2fa421c5bb6
Instruction Fuzzy Hash: 23214135E042099FCB14EFB9C8546EEF7B6FF89300F10862AD509A7650DB359985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05C00718, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9056677b94f1d1f831862d935bb3ff8ea91d1d06966aa5a91079ba568e9711f0
Instruction ID: a883f5c1f53759fae691556afe35eb6ab157972d74686f90699f433d435a3b1c
Opcode Fuzzy Hash: 9056677b94f1d1f831862d935bb3ff8ea91d1d06966aa5a91079ba568e9711f0
Instruction Fuzzy Hash: 9211B1363042109F8708EB6DE858A3E73F7EFC96143158529E506DB391DF36EC028BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05C0E0C8, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c27a9a68eb5582f42165275901440f1b3d8b7f34c564221ff63f7b95f341063
Instruction ID: 958f11a437a72a739c3d922c4747b7be591095ee3a99ee04833c8b6fc3cae942
Opcode Fuzzy Hash: 4c27a9a68eb5582f42165275901440f1b3d8b7f34c564221ff63f7b95f341063
Instruction Fuzzy Hash: 0E21B332E106189FCB05EFB8D8044EEB7B6EF89310B11CA2AE9066F251EF719955C791

Uniqueness

Uniqueness Score: -1.00%

Function 05C039F7, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f025138176e897ed9db6eae82670cd219afb1c08773cc07052b66715751498
Instruction ID: 981873d77f3837c1bb2546d689587c3c26f40493c32c19cfd23e2ef1fdcda466
Opcode Fuzzy Hash: 21f025138176e897ed9db6eae82670cd219afb1c08773cc07052b66715751498
Instruction Fuzzy Hash: 9E31CC35A001449FDB04DBA8C584EEDBBF2FF48324F1A9594EA05AB365D732ED41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C0E228, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462aa6e5996ab53fdd42afa154dd84ee4b2744cb944ae8017afd6fca8d998f60
Instruction ID: 522a9650b7331757ec01be22d88ee367b6f9beb65fe85d9e211aa2d364940625
Opcode Fuzzy Hash: 462aa6e5996ab53fdd42afa154dd84ee4b2744cb944ae8017afd6fca8d998f60
Instruction Fuzzy Hash: 7121083028D290CFD7169B66991863D7F3FEF82205B0A6C97D183CA5D6CB249C02C353

Uniqueness

Uniqueness Score: -1.00%

Function 05C02A58, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6030a43bdd150243661f317bea7f0168058a943bd359b7cd66860deb114e90ba
Instruction ID: dc930295e4eaac58a511d0c328816c56662b05c23bedd4fe592bb29bb05c7885
Opcode Fuzzy Hash: 6030a43bdd150243661f317bea7f0168058a943bd359b7cd66860deb114e90ba
Instruction Fuzzy Hash: 5021C334A08625CFCB25DB65C8087AAB7A2FF88704F04487EC506DB281DB719942CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05C014B0, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b93b2fd56e526cbfdc13b5759c9739289168bd2128535473c19a709ac8d7316
Instruction ID: 183f6926efc839c06b33ec03fa5054a65cfcd3fe9c4ad53fda50efc065fd4de4
Opcode Fuzzy Hash: 2b93b2fd56e526cbfdc13b5759c9739289168bd2128535473c19a709ac8d7316
Instruction Fuzzy Hash: 272119742046108FE736EF38E61551AB7A2EF8521A3018E38D15AAB794DB39FD45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05C0D030, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36418fb3d2444d614794b35a3a3120448237737f3bdbda58f62ed2fc8727ba2a
Instruction ID: 9c61f1d1a3bae8ac6a848bd200a317659535fdc65da8abd1bed4178a4aa52183
Opcode Fuzzy Hash: 36418fb3d2444d614794b35a3a3120448237737f3bdbda58f62ed2fc8727ba2a
Instruction Fuzzy Hash: 0A11D6712083205FC310EF74A51166B7BE3AF82208745CE69D106DF781CF39AD0987D6

Uniqueness

Uniqueness Score: -1.00%

Function 05C02A68, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d302d991cfbdd09b9b23fc40571a5b72330e4bd39b868024388d4801228fc7e
Instruction ID: 93305ca9488c4e31f018144ff4f1c3d037390c35f92f443c097f7fd29edcf786
Opcode Fuzzy Hash: 2d302d991cfbdd09b9b23fc40571a5b72330e4bd39b868024388d4801228fc7e
Instruction Fuzzy Hash: 1E11A534A08221CFCB25DB65C4187AAB7E2BF88304F145879C10ADB381DF759942CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05C03CA0, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd4c4ea0a0adf3a6fe7689c77b8aa763e1687cc9c898635dc436bc69bf798b29
Instruction ID: cfdd5a772f34387edcaf845811f7c1e8949b219b133ac55b9209f85961851f05
Opcode Fuzzy Hash: dd4c4ea0a0adf3a6fe7689c77b8aa763e1687cc9c898635dc436bc69bf798b29
Instruction Fuzzy Hash: 27113A36414248EFCF069F90D808CA8BFB2FF49711B0A8891F605AB0B2C736D925EB51

Uniqueness

Uniqueness Score: -1.00%

Function 05C08CB0, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5af503ab0b2af0a659bbbc1348dd4f6bf04dbd419443a4d4cd8dbc11889053d
Instruction ID: 54e7703559fcaae354f1ab2479b5b86386a6282cec27de20f23b7d09f67e370e
Opcode Fuzzy Hash: d5af503ab0b2af0a659bbbc1348dd4f6bf04dbd419443a4d4cd8dbc11889053d
Instruction Fuzzy Hash: 9801443170C3605BDB18A63A84042BE3AEBAF82160F08ED3AC44BCF7C1DE28D9419361

Uniqueness

Uniqueness Score: -1.00%

Function 05C009C0, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58fd75e227a6f0f8dfe62a63ab68c40792c56231cb5f4b6f6542ed8e26235397
Instruction ID: 16446e8a657ddfad9eb00ab1394436fcb124713a43468ae260fb1d82f27e522e
Opcode Fuzzy Hash: 58fd75e227a6f0f8dfe62a63ab68c40792c56231cb5f4b6f6542ed8e26235397
Instruction Fuzzy Hash: A111D03130C2549BEA24E729941422E73A7DBC160C74ACD2ED11EBB7C0CB26FC438795

Uniqueness

Uniqueness Score: -1.00%

Function 05C047B0, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf8ea6351869bbd6cebb56a931bc7449a389271f4f4a4f71177c5a1ed8a4214
Instruction ID: 4a2bcbdf3bc8880ca56de3c5102604c9faacb4b9cbdd63da4cb620431a619e06
Opcode Fuzzy Hash: 3bf8ea6351869bbd6cebb56a931bc7449a389271f4f4a4f71177c5a1ed8a4214
Instruction Fuzzy Hash: 65212732D00B4AD6CF11EBA9C8501DAF7B2EF95310F119B1AD69977550EB70B2D9CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05C00C18, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4b9f750c6f87728d5fed517c9858f83a1b03950c832578ccfa54f25a77cb8c
Instruction ID: 60e5cedcaab0054e8231c32f0fc4302fbfa6bf1f6b4ecb0441af2e69816236f6
Opcode Fuzzy Hash: bb4b9f750c6f87728d5fed517c9858f83a1b03950c832578ccfa54f25a77cb8c
Instruction Fuzzy Hash: 4E119D30308600ABD724C746C984E2AF3EBFFC8268B55D919D45A93B90CB31FC42C652

Uniqueness

Uniqueness Score: -1.00%

Function 05C03CB0, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154aeac0fce2fd500e6437e80053f48e3572b54d1e77e774f59b63f46d8561e2
Instruction ID: c16bc99bed5917c5f9d1ca3fb3ee4a8efba237853a49e61269784a7f72bb6195
Opcode Fuzzy Hash: 154aeac0fce2fd500e6437e80053f48e3572b54d1e77e774f59b63f46d8561e2
Instruction Fuzzy Hash: 1F111336410158EFCF068F80E808CA9BFB2FF08711B0A8891F2066B0B2C736D965EB51

Uniqueness

Uniqueness Score: -1.00%

Function 05C03790, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4817327c31ffcda3ea38710ebaac06b56a01e94c7245a8c54f8e410191c9ba29
Instruction ID: c45e15cd5dc1ee8f67b37938f46a3625fc927f4ddfca344c2981d2bfb3466dac
Opcode Fuzzy Hash: 4817327c31ffcda3ea38710ebaac06b56a01e94c7245a8c54f8e410191c9ba29
Instruction Fuzzy Hash: 4811BF70B08288CBDB15DB65C0147BEBBB3AB84A18F145DAEC142A77C0CB795985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C047C0, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f25e7363ba8b5583c305bb42971eda4f1bb217ea24f18f75c0b501da8ce9f11
Instruction ID: cf562a62862f48e0b546b7f3b9ad3ab290d1efbe3875fe8e50bf2be642c44051
Opcode Fuzzy Hash: 4f25e7363ba8b5583c305bb42971eda4f1bb217ea24f18f75c0b501da8ce9f11
Instruction Fuzzy Hash: CA211732D00B4AD5CF11EEA9C8504EAF772EF95310F119B1AD6A937550EB70B2D9CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05C0A448, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b6ca4512cf33ad908e8a301a8577f82b130263b2e002a98e6b816ea899fe81a
Instruction ID: 5c4bd1117977d76d5bd69d3aeda175814f0ba82e020f9c6f680ab526178a36cd
Opcode Fuzzy Hash: 7b6ca4512cf33ad908e8a301a8577f82b130263b2e002a98e6b816ea899fe81a
Instruction Fuzzy Hash: 3001D8357192445FC7145ABA5C2867FBA9BEFCA210B158476E506C738ACE3C8C0586A1

Uniqueness

Uniqueness Score: -1.00%

Function 06AA15C0, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8f3e134edd74050ad6bee2974f7dcb72e32033eb813907e5ef69c05a7315fb
Instruction ID: 9236c36dbf6f23dffde0eae181e4f8492a83f539ce46a8b2c121f158176e8aed
Opcode Fuzzy Hash: 6a8f3e134edd74050ad6bee2974f7dcb72e32033eb813907e5ef69c05a7315fb
Instruction Fuzzy Hash: 1E019239308382FF97943B25A41847E7BB7A6C5266F0C445BE517C7340CB248C05DBE2

Uniqueness

Uniqueness Score: -1.00%

Function 05C0F2B1, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421ab9c4a63f102c4e0dd8942a4d5d7076e81b43808dafc93b6d52e7ca5f683f
Instruction ID: 97d15a9fc2652dc480bc16bc8f770fca921114828465c2e29a33da86bcaa3d77
Opcode Fuzzy Hash: 421ab9c4a63f102c4e0dd8942a4d5d7076e81b43808dafc93b6d52e7ca5f683f
Instruction Fuzzy Hash: A111CB70308611CF9B34CB6AD55093AB7B3BF88664325ACAEE446CB2B1DA20CD84C712

Uniqueness

Uniqueness Score: -1.00%

Function 05C07F70, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb2525b3d2f336312ce93d6f0f33eaf895f59c8ab056592523d3558db1f874a
Instruction ID: 7413ae331f7d2591307f6446089693b6c5b0960ab37bae0598673f09c162f4d3
Opcode Fuzzy Hash: 3fb2525b3d2f336312ce93d6f0f33eaf895f59c8ab056592523d3558db1f874a
Instruction Fuzzy Hash: 30016D787085109FC71CDB3AC940D39B3E7EF84664B01986AE507CB7A1DB20EC028BA2

Uniqueness

Uniqueness Score: -1.00%

Function 06AA1332, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be20f73485012ae74f6246844ed6c816885dcb888774a64b35c5ad869a7331fb
Instruction ID: 99b40d8f77435704feafa5f109b666fd6192ce2dfc409c7aeef2c72b37e530ab
Opcode Fuzzy Hash: be20f73485012ae74f6246844ed6c816885dcb888774a64b35c5ad869a7331fb
Instruction Fuzzy Hash: 6D01282130D1941FE715667C591072F9ADB9BCA604F19CA3EA20A87785CF288D4243F5

Uniqueness

Uniqueness Score: -1.00%

Function 05C04879, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09af6f84d6144ed339376e87d39e2c261cab2c4747f3abc78fef84b2f901f6a4
Instruction ID: 1a58bfc0af16b6031ef93610b607905b33541fafd0bc422b56b2859010e44fcc
Opcode Fuzzy Hash: 09af6f84d6144ed339376e87d39e2c261cab2c4747f3abc78fef84b2f901f6a4
Instruction Fuzzy Hash: 2611E570E041989FDF08DB9AE9846AFBBF2FB84301F108A66E305D7294DB306D11C791

Uniqueness

Uniqueness Score: -1.00%

Function 05C02237, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1deee8ef6d9340de331cabf5c325b7d969332fbe5fb29a9e9631380d1b2529e4
Instruction ID: 510177686e59e3d2a8b4934cfd7c7d5cb46d932cbabe1e098d39f6703cdd6225
Opcode Fuzzy Hash: 1deee8ef6d9340de331cabf5c325b7d969332fbe5fb29a9e9631380d1b2529e4
Instruction Fuzzy Hash: 9911AC38605300CFCB24DB71D44496AB7A2EF85214B10A93ED542CBB90DB36E945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05C00440, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e32b53ce592480dde770fd7f5f44549b4a9675e3d45064b73ca8ee539ba7713
Instruction ID: 35f9e400df7993a53874a7d6f2ba86ecc17873bc91e3ea0145dc06d4a0303096
Opcode Fuzzy Hash: 2e32b53ce592480dde770fd7f5f44549b4a9675e3d45064b73ca8ee539ba7713
Instruction Fuzzy Hash: 7C11E3B06043909FE315EB38E5197553BE3EB06205B06C998E04A9F792CB38AD45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05C05840, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6f1b94bc9ad9920f9cc24ddca37db7331babd50262c8286969781de5e48924d
Instruction ID: 2e763df4491f713e889aa08a9c494bd452e6f19bc296452ceff715ac740fc3d9
Opcode Fuzzy Hash: b6f1b94bc9ad9920f9cc24ddca37db7331babd50262c8286969781de5e48924d
Instruction Fuzzy Hash: 8D01AD31258208CBEB299BB5E46016977B3FB84314B050E2AC54B87B90EF39AD19CB41

Uniqueness

Uniqueness Score: -1.00%

Function 06AA06C0, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc228af15d59f8ae45d7170f2b61494faac2efbcf86200301e39a7a81cd7105
Instruction ID: 27c70499ca98b2b71d727c330c23cbd3228175fffadeaa5939ffcd776297b56b
Opcode Fuzzy Hash: 8fc228af15d59f8ae45d7170f2b61494faac2efbcf86200301e39a7a81cd7105
Instruction Fuzzy Hash: 6C01D432B00E114B8765EAA8D80099B73EAAF88624314C52ED809CB344EF35EC0287C0

Uniqueness

Uniqueness Score: -1.00%

Function 05C00430, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986dc608f7957bf112c85f3c9a58a1a663fca58291bed1f55db3b591d45c7850
Instruction ID: 81c1d804c329ebff1955bd668850ae48566e4c0156e082f43daafe19671b8b1e
Opcode Fuzzy Hash: 986dc608f7957bf112c85f3c9a58a1a663fca58291bed1f55db3b591d45c7850
Instruction Fuzzy Hash: 521125B16092905FE306AB28F1196547FE2EB06211B0688E6D449CB2A2C738ED45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 05C05850, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7696264588657f01b839ed62faa4a79decb1989040464398fbc44cd1e75882ac
Instruction ID: d03d6dacac37fdaffc0902d7896de8659567efce774f229267e34d282ca61adf
Opcode Fuzzy Hash: 7696264588657f01b839ed62faa4a79decb1989040464398fbc44cd1e75882ac
Instruction Fuzzy Hash: AD019A322592088BEB389B75E46446A77B3FB857147160E2AD50B87B80EF39ED09CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05C01DC0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a15e0904934e83179d04ad03e5850efa81dec224754627aebe649b2849a5d09
Instruction ID: 4063ccb56bdaa5571985aa4341b11de066307886e731e064726a38a7521af349
Opcode Fuzzy Hash: 3a15e0904934e83179d04ad03e5850efa81dec224754627aebe649b2849a5d09
Instruction Fuzzy Hash: FB01A431700210AFD7217B79E8185AFB6DAEB887563449939F90ACB341DE39AC0287A0

Uniqueness

Uniqueness Score: -1.00%

Function 05C07950, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48564073ad66a47e73fed13ac7882f608931ce012aff4658d647385cc5f3778f
Instruction ID: 6b081294445209afd6d4ca9f97ecff7e4cf22c1fa8a67eaaa6477bc1ab6d4195
Opcode Fuzzy Hash: 48564073ad66a47e73fed13ac7882f608931ce012aff4658d647385cc5f3778f
Instruction Fuzzy Hash: A8018F316082189BDF1CDB56C510ABEB7F3EB85210F05692AC547AB2C0CF75BA058BD1

Uniqueness

Uniqueness Score: -1.00%

Function 06AA0640, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 441ce9df38b094e7dccda493aea9bd9daa7587ed71a7d5460190c441d1b2780d
Instruction ID: 20fdb6f5ac76e32b29f5ca05c03815eaf4f38050e2cbf19beed1ecd91e16be17
Opcode Fuzzy Hash: 441ce9df38b094e7dccda493aea9bd9daa7587ed71a7d5460190c441d1b2780d
Instruction Fuzzy Hash: 0E01263070CB900F8325972C686055F7BEBDFC6218316897AD20ACB256DF108D0543EA

Uniqueness

Uniqueness Score: -1.00%

Function 05C03DC8, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1107392f3f84c81f0643503a5ab14ddf46294a4b1d7329937af9c41b586ef03e
Instruction ID: d909f2732ede96693d9c75835b10c6d7139620f40f6564758d5b0a3e149a9ec8
Opcode Fuzzy Hash: 1107392f3f84c81f0643503a5ab14ddf46294a4b1d7329937af9c41b586ef03e
Instruction Fuzzy Hash: 99018C30608280CFD725EB66E5193657693FB44A06F006E2AD0668A2C4DB7D9981C792

Uniqueness

Uniqueness Score: -1.00%

Function 06AA1457, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f32f457724318e6b26cec4d8b17e5279214473fd6c51e6b51941d3fca181a9
Instruction ID: f6b236106311918ca5eafb02d393cf69224f7318956c31a64a42ee7a9398ff03
Opcode Fuzzy Hash: 11f32f457724318e6b26cec4d8b17e5279214473fd6c51e6b51941d3fca181a9
Instruction Fuzzy Hash: D001E9B0D0530ABEDB90EFADD805B9FBFF4AB08614F10856BD416E3241D77446458BE1

Uniqueness

Uniqueness Score: -1.00%

Function 05C07947, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82520c8f12f21e93f62ebd3977d20c07b98532954daac8569ce288d0fc6ea3bb
Instruction ID: f5db303a218341e66d15dab68e541b1510df68a20f66b182f5d6c33317e3ae2f
Opcode Fuzzy Hash: 82520c8f12f21e93f62ebd3977d20c07b98532954daac8569ce288d0fc6ea3bb
Instruction Fuzzy Hash: 74018F3160811497DF5CDB55C5506BEBBF3EB85204F056929C443AB2C0DF75BE0187C2

Uniqueness

Uniqueness Score: -1.00%

Function 06AA1508, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f352185491f8bf225c28282708506a676689e0615477184073e3b4623efa08a
Instruction ID: d97a1cb43e7e06b2759e4fcc5a55c55883c0f56f5579bf1479d5df32ea00b984
Opcode Fuzzy Hash: 6f352185491f8bf225c28282708506a676689e0615477184073e3b4623efa08a
Instruction Fuzzy Hash: E3F0467161C752FF97987A15A41487F7B768EC9210B04802BE5478B500CB208C01D2D2

Uniqueness

Uniqueness Score: -1.00%

Function 05C044E8, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9330690e1aa4c2c84d89f1602f83b0c7c5387b60ba13031684964598f27e2c9
Instruction ID: b39d1317c0a5db56066dd6d226512cc9e6afadc41389c9b992af2da480a3b835
Opcode Fuzzy Hash: d9330690e1aa4c2c84d89f1602f83b0c7c5387b60ba13031684964598f27e2c9
Instruction Fuzzy Hash: 55012830E04204CADB28EB74E8483EAB3B2FF85301F10DA6AE205571D1EFB0A9D0CB41

Uniqueness

Uniqueness Score: -1.00%

Function 05C01DD0, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 019772058a2fec9b6951047410ace3eacaf0d0d4a2c754caef65b94f1b11a9f5
Instruction ID: a0bfdc8d970a10bb5aa42902583a4300eab4269a6b6365e6febcb3aac4a4afb5
Opcode Fuzzy Hash: 019772058a2fec9b6951047410ace3eacaf0d0d4a2c754caef65b94f1b11a9f5
Instruction Fuzzy Hash: 50F09631700210AFC7157779A91846FB6DEDB8D6563449939F90BC7341DE39EC0187A0

Uniqueness

Uniqueness Score: -1.00%

Function 05C06E1B, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5abc8c0c7f01cf2f3d41008855d345bcec45d28bf6a109deef3cead2dd4f8e0
Instruction ID: 0e1abefc0b55becd142e89aac105bfcce0a134f611e9cc20b0adb99ec2249d7f
Opcode Fuzzy Hash: f5abc8c0c7f01cf2f3d41008855d345bcec45d28bf6a109deef3cead2dd4f8e0
Instruction Fuzzy Hash: B30149323086108BC714EBB8E10121833E3EF8A2107414D3EE106DB780DF34AE958796

Uniqueness

Uniqueness Score: -1.00%

Function 06AA1402, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b51f2fbab3e2d402af517808794bfcdaa5c7ce42561ad27f97ac796b2c4188c
Instruction ID: 9be879697bf6427de4b13b2a4c164a53380ce393ea39b58771e6eb6218444504
Opcode Fuzzy Hash: 9b51f2fbab3e2d402af517808794bfcdaa5c7ce42561ad27f97ac796b2c4188c
Instruction Fuzzy Hash: 71010CF4E4120ABFDB90EF69D514BAE7FB0BB58218F20856AD015DB210E7754A068F90

Uniqueness

Uniqueness Score: -1.00%

Function 05C0E0B7, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ad796e40fc26f474f346f86a1eb28c5cafc57282f3b4a58ffeeba5f736a4cf
Instruction ID: b55e0a661f759a3490cb92c020b3f1d5331377ceca0b619d213166547a8b7f41
Opcode Fuzzy Hash: a4ad796e40fc26f474f346f86a1eb28c5cafc57282f3b4a58ffeeba5f736a4cf
Instruction Fuzzy Hash: 93F02832A00204DEC7149A74C8185EEB77BFF88341F008D6BEE02AB291EF708654D790

Uniqueness

Uniqueness Score: -1.00%

Function 05C04040, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eef7498f280054b577d4202b1d8c2ac07a5c2ed1012d8b8e18be1dc2d99e9501
Instruction ID: 11db6e3af3db1ae3219b99a4247aafcaa47e85dc5a1668a580691cfd098ff0a4
Opcode Fuzzy Hash: eef7498f280054b577d4202b1d8c2ac07a5c2ed1012d8b8e18be1dc2d99e9501
Instruction Fuzzy Hash: 0C01AD31E007159ADB00E77AC8056ABB7B3EFC2214F149B6AE2056B241EF74A0D1C7C2

Uniqueness

Uniqueness Score: -1.00%

Function 05C06E28, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad147c180cee1876fb6533b5cc095dc0e6441781fd236ac45a3b6a18926919e
Instruction ID: dd1ba58257c9c78d98e0eedbea5e866ae4d952b12c45bcce57c501d6c644938c
Opcode Fuzzy Hash: 5ad147c180cee1876fb6533b5cc095dc0e6441781fd236ac45a3b6a18926919e
Instruction Fuzzy Hash: 84F028323086209B8A14EBB9F00551D73E3EFCA2543414D3EE10ADB780DF34AE9587D6

Uniqueness

Uniqueness Score: -1.00%

Function 065C1098, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509106767.00000000065C0000.00000040.00000001.sdmp, Offset: 065B0000, based on PE: true

Associated: 0000000C.00000002.509088108.00000000065B0000.00000004.00000001.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcef15b902f9e57172221ec67b88f28c84b79e78959ee218630233d178fc7ad2
Instruction ID: e299458d664eaf9599b9776219360e7e32abaa0295c1fdf1441e989d58ef6cd0
Opcode Fuzzy Hash: bcef15b902f9e57172221ec67b88f28c84b79e78959ee218630233d178fc7ad2
Instruction Fuzzy Hash: D5F0C2123091685FEB2422BD691136F65CF8FC7268F09887ED50B9B782CE59DC0103F6

Uniqueness

Uniqueness Score: -1.00%

Function 065C0EA8, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509106767.00000000065C0000.00000040.00000001.sdmp, Offset: 065B0000, based on PE: true

Associated: 0000000C.00000002.509088108.00000000065B0000.00000004.00000001.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa39d61084a20592c081ad3853590d4a7e0824ce0d04a5f6ec64eff3cfab017
Instruction ID: 172d6336ce5cdddbb8ca2c4fbcdbc4d588dab22b52197f0a59127eef97279bf5
Opcode Fuzzy Hash: cfa39d61084a20592c081ad3853590d4a7e0824ce0d04a5f6ec64eff3cfab017
Instruction Fuzzy Hash: B2F0AF123091A45BEA2422BD69153AE65CB8BC6264F098C7DE10BAB781CE599C0103B6

Uniqueness

Uniqueness Score: -1.00%

Function 05C07B77, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c1bd946c5049af409838dc40be5839802d48d51a574466270ff7be981e0011
Instruction ID: a67b96d48d7525b6fb4d2cefc85dd7ba77dacdffa8fa2ba10f5cc6f1ed3c8594
Opcode Fuzzy Hash: f5c1bd946c5049af409838dc40be5839802d48d51a574466270ff7be981e0011
Instruction Fuzzy Hash: 0FF08130B001258BCF09FF64D552AED7363EB84618F01DA28D506AB2C6DB74AAC587E5

Uniqueness

Uniqueness Score: -1.00%

Function 06AA0778, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dc0519ef0552ce6acdcd2404d2e9381ab2a89ec5ef1f790afa6893d6ef2efd9
Instruction ID: 5efef6a820e01e06d8a55fc623d621522a8b470e3d6bc0ae3b6f86a5d80bc737
Opcode Fuzzy Hash: 0dc0519ef0552ce6acdcd2404d2e9381ab2a89ec5ef1f790afa6893d6ef2efd9
Instruction Fuzzy Hash: 79F0F03A2416504FC3219B24E818DDB3BBADB8A22470502A6F889C37A2C624ED85C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05C04050, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 273adf38f7b388e2f87fe8dd48ea6e9abdd53f08698d70012d01ea12e609a9e3
Instruction ID: b004de829db5e4e8fa588eea0411270d0d14463e6f52ef898db9d1c50f8d3798
Opcode Fuzzy Hash: 273adf38f7b388e2f87fe8dd48ea6e9abdd53f08698d70012d01ea12e609a9e3
Instruction Fuzzy Hash: F9F0C235E0070596CB04F67AC8455EBB3B7EFC6300F109B6AE6052B280EF70A4D1C6C2

Uniqueness

Uniqueness Score: -1.00%

Function 05C0A218, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f52f68dc75688cae5608d5612b95ca7b3be5cf72f95391695b5d7bb7b4bd5b7
Instruction ID: b10769c730bfe655d3ae4e1b689bb6f813c61bc4f637cf7089635d05d03d65e4
Opcode Fuzzy Hash: 9f52f68dc75688cae5608d5612b95ca7b3be5cf72f95391695b5d7bb7b4bd5b7
Instruction Fuzzy Hash: F1018170815208EFD700EF94D985E8DBBB1FB05308F019A58F5049B2A4D774AF89DB40

Uniqueness

Uniqueness Score: -1.00%

Function 05C0E219, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec66f0c3ac0084723fd1d445daecbe3402052988884b15ef06fde3646b9bd474
Instruction ID: 60c3af881aaa2c0e3235ee75b34b60f0aa8797b7d9808a75313ecca001f29fcc
Opcode Fuzzy Hash: ec66f0c3ac0084723fd1d445daecbe3402052988884b15ef06fde3646b9bd474
Instruction Fuzzy Hash: 13F0F0353CD400CBDB289B929A6823D7B3FEBC0245B06AC16D143966C4CB34DC11D742

Uniqueness

Uniqueness Score: -1.00%

Function 05C07C58, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03df9bbfe172e484e2ccacdac6a83259dd6e2b93e42402f631160f8adc5be115
Instruction ID: 3b5ca258fcb9cbac2b5899cf5a29b2bfed592fad939f626cc51f22ff1c917a79
Opcode Fuzzy Hash: 03df9bbfe172e484e2ccacdac6a83259dd6e2b93e42402f631160f8adc5be115
Instruction Fuzzy Hash: DCF0963051D3A08FC31AC36A845CA257FE6DB42211F0ADCA7E05ACF5D2DB65EC41C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05C0DFE0, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69d6c609f6f8311b20c9a822409a371c6ddb526f1b807040316296369c8af12
Instruction ID: c34ea83ad97351f78b9d0036285faa2e092d5679d823cc7e80a49b0ab3363b24
Opcode Fuzzy Hash: c69d6c609f6f8311b20c9a822409a371c6ddb526f1b807040316296369c8af12
Instruction Fuzzy Hash: BD01A431014248EFCB049F54E4285BB7BB9FF55300B059956F54A872A2DF715E40DB51

Uniqueness

Uniqueness Score: -1.00%

Function 05C02500, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140488d5bec9d41270dd7c0da95e716dd3124b250d14b20b8a65b64454b9c206
Instruction ID: a74fcaf2d694066069520acf5fa69acc4b155ac0f79cd330e7a08fa800bd2378
Opcode Fuzzy Hash: 140488d5bec9d41270dd7c0da95e716dd3124b250d14b20b8a65b64454b9c206
Instruction Fuzzy Hash: 2BE0E52B70812457EB31516EECAC7A9EA8BE3C5335F0428B7D94FC72C194114C4483B5

Uniqueness

Uniqueness Score: -1.00%

Function 05C06AEF, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e39a51019d415659837fa5de04ee586f7aefe9eb05e49af3c1375b99cfc4964
Instruction ID: bbf76e13c25ae509b3954d6a55c2e586ea7ab2298dda086397ae3d738d67319a
Opcode Fuzzy Hash: 1e39a51019d415659837fa5de04ee586f7aefe9eb05e49af3c1375b99cfc4964
Instruction Fuzzy Hash: 87F0B4F205C115CBE200FE42DA81AA43753A660308751DE26A251C62C4E7F8ABE6E792

Uniqueness

Uniqueness Score: -1.00%

Function 06AA0630, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 638d168453a3d525afb39b6ec4cd47bf2e21f9c978ac2ce5ff136a0d7f305616
Instruction ID: 44897402d7c2e15a075d6f937387b09d214d03912bedcd35343e1272570123cc
Opcode Fuzzy Hash: 638d168453a3d525afb39b6ec4cd47bf2e21f9c978ac2ce5ff136a0d7f305616
Instruction Fuzzy Hash: 9BF02E31208B515B83149B6FAD50547FBAEEFC12643158A7AE14DC7611DF30AD14C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 06AA154E, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92fd31e180191990ec03cfa9a19152da431c9ab180eda6a0d98674f0108e25b8
Instruction ID: f3c98a3b12747f742c6368ba2ffe68966e4c4788a929102711f01f426c92b2e5
Opcode Fuzzy Hash: 92fd31e180191990ec03cfa9a19152da431c9ab180eda6a0d98674f0108e25b8
Instruction Fuzzy Hash: 5CF05E71A58313FFE7943A05E50893D77BAABC5211F048417E5434B500CB31EC46D6D6

Uniqueness

Uniqueness Score: -1.00%

Function 05C0F378, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2b582bb8d82152f004c4d4df41227f7f547945f1b635cbf26d8b604193b0bbe
Instruction ID: 658bea79aebfaefa5d0c35d65ce2226379efbd37bb8a3212453b879514733262
Opcode Fuzzy Hash: f2b582bb8d82152f004c4d4df41227f7f547945f1b635cbf26d8b604193b0bbe
Instruction Fuzzy Hash: 99F02735700109CBDF20A7A9D8646AF73ABEF84354F818868EA05DB290DB30ED9DC390

Uniqueness

Uniqueness Score: -1.00%

Function 05C0EF8A, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1e878821a3f788cda596b1d613c6dca2aa25ba953edaf08814daecb7e245fb
Instruction ID: 3c9da0df1771824fe1edaa9de22004243acbe487a48087de37691012e0434a1c
Opcode Fuzzy Hash: 7a1e878821a3f788cda596b1d613c6dca2aa25ba953edaf08814daecb7e245fb
Instruction Fuzzy Hash: 94F0892468D1B9CFD714830AC414536BFEF9B42341B4ADC92E05A8F4E2D635D941C711

Uniqueness

Uniqueness Score: -1.00%

Function 05C0EF98, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1669d25bcf421013ad87873bfca3d2908e8b40b1ed60d3068ac713f0347e3b
Instruction ID: 1178a8a7fa463d6d22cf33a81d7b5d72900114aba172b8c8f8665b0576cae8da
Opcode Fuzzy Hash: de1669d25bcf421013ad87873bfca3d2908e8b40b1ed60d3068ac713f0347e3b
Instruction Fuzzy Hash: 2CF05E3424D2A98FC715931A8418535BFEF9B82201B0A9CA7E05ACF5E2C664DC45C762

Uniqueness

Uniqueness Score: -1.00%

Function 05C0BD68, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc5ba87d21e8fcf16ee397ea3caa3b1f9432dca0d6e2fddd64d00e6da5b434a
Instruction ID: 5d12a57cfcb2dd4715021d7d82a65de52c3c560bc326775d36dff19e3219ee00
Opcode Fuzzy Hash: ddc5ba87d21e8fcf16ee397ea3caa3b1f9432dca0d6e2fddd64d00e6da5b434a
Instruction Fuzzy Hash: CEF09031419609EBC740EFA0E585F9DBB76BB05309F01CA14F4009B264DB349A89CF82

Uniqueness

Uniqueness Score: -1.00%

Function 05C04AE1, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b91b764fc3756cf65cfce7202eaac8be8b94c294f44060cf4a8599abb7614a16
Instruction ID: ee358eb7bb00c32fe400de68716609a8ca2ee650acfab22d9dadaed1cf1ed17e
Opcode Fuzzy Hash: b91b764fc3756cf65cfce7202eaac8be8b94c294f44060cf4a8599abb7614a16
Instruction Fuzzy Hash: A3F09036F04B048ACB04BAB6C4401AAF3B3EFC5301F109B6BE1056B284EF7195D18281

Uniqueness

Uniqueness Score: -1.00%

Function 05C0A228, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84567fbd7f2d0572afe6a8a5b6b1cdb828fd0db36880e03d5e252b1db1723732
Instruction ID: 78a2418a4b55cd9a79a206b90bdd630ee5621136b900a528ef10c6252183754b
Opcode Fuzzy Hash: 84567fbd7f2d0572afe6a8a5b6b1cdb828fd0db36880e03d5e252b1db1723732
Instruction Fuzzy Hash: 1BF04F70809209DFC700EFA4D64999DBBB5FB01309F019A58E4049B364D7749F98DB41

Uniqueness

Uniqueness Score: -1.00%

Function 05C07C48, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 058a3f64b9adfe97565b9d7ff1f223b25f0f723952e9ab4d45745fa458acc6da
Instruction ID: 48641175a690180404ea1f1209f482e0c7221689925427635bf4c462670eac8f
Opcode Fuzzy Hash: 058a3f64b9adfe97565b9d7ff1f223b25f0f723952e9ab4d45745fa458acc6da
Instruction Fuzzy Hash: 85F0E230A182708FD32CD256849C9347BEAEB42221B06DC9AE04B8F1D1DB64FD40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06AA12E8, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7067534f8cec0e2634cb4edc489b13c4e2c37a31f56db21b0fb6007b9aa7df82
Instruction ID: 01086141f6202f831824643c483d1610df1f32e70885786c000c59a864b53f3f
Opcode Fuzzy Hash: 7067534f8cec0e2634cb4edc489b13c4e2c37a31f56db21b0fb6007b9aa7df82
Instruction Fuzzy Hash: ADF0EC31706B905FD735DB27941059BFFDA8FC6618F04C46FD0CE8BA12C664984587A1

Uniqueness

Uniqueness Score: -1.00%

Function 05C02471, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcfc8d9616a0f1122d29e6d89de3669140bdb9a2aa36a0ea3e1d0d6712f586f8
Instruction ID: cc588cf0d1847fc8e7880d518460646851faf6b88a36d3077758d710010ebaa6
Opcode Fuzzy Hash: dcfc8d9616a0f1122d29e6d89de3669140bdb9a2aa36a0ea3e1d0d6712f586f8
Instruction Fuzzy Hash: C9F02B352042145FD722D759E420A3A739BDFC1628B458C2FD619DB340DF66FD0287C0

Uniqueness

Uniqueness Score: -1.00%

Function 05C05742, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f1d19c71edcdd44d68a73566ed9d2638f35f4b00e560a1570cfea27dbcedb3
Instruction ID: 4e3517f9e6e90cb89f97aa0872ff24dac89bb4aa41163331402cda7b9708703a
Opcode Fuzzy Hash: 46f1d19c71edcdd44d68a73566ed9d2638f35f4b00e560a1570cfea27dbcedb3
Instruction Fuzzy Hash: 99F0A03412D294DBC601EF1DE9C0DF93B77AA80209302AE529202CB1A6D3345E56EF83

Uniqueness

Uniqueness Score: -1.00%

Function 05C098B8, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f53cc8eed771be74a5595b4d681f689d5f330dc8f5fb1506a1ba9b4aea1e4be
Instruction ID: 315c4dc32885746f4791d7b8871b7183ef301e8fd7314278d4134b7e052745da
Opcode Fuzzy Hash: 1f53cc8eed771be74a5595b4d681f689d5f330dc8f5fb1506a1ba9b4aea1e4be
Instruction Fuzzy Hash: EBF0A731819209DBC700EFA0EA46F9D7B76BB41309F019615E2049B164DB345B98CB65

Uniqueness

Uniqueness Score: -1.00%

Function 065C3260, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509106767.00000000065C0000.00000040.00000001.sdmp, Offset: 065B0000, based on PE: true

Associated: 0000000C.00000002.509088108.00000000065B0000.00000004.00000001.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572a781439f9d28eb957367a0435a282c15588d57fa25160d375bb2ced2186cd
Instruction ID: cb32b76771e54b597e7fe7d711ffa1dbd99bdfa6b911aed248cd93b9ee5f9455
Opcode Fuzzy Hash: 572a781439f9d28eb957367a0435a282c15588d57fa25160d375bb2ced2186cd
Instruction Fuzzy Hash: 3BE0DF01B5825E5FFBD432F80C3033E116A7BC1478F50E42E89669A3C1ED48A80003F3

Uniqueness

Uniqueness Score: -1.00%

Function 05C00C08, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de43225105540ee30826e99e9fe0f9a7e2bebd2915c75744946f915322c135ee
Instruction ID: 0cc16c047f1f838367719984aabc2612808cf75408bc36bdd1bd1413d028a2e0
Opcode Fuzzy Hash: de43225105540ee30826e99e9fe0f9a7e2bebd2915c75744946f915322c135ee
Instruction Fuzzy Hash: 58E06D31304511AFD710D61AE881E66F3DBFBC9274B54C52AD90E87B50CB35AC03CAD1

Uniqueness

Uniqueness Score: -1.00%

Function 05C03A08, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7398b7e2acad346a2d65205bfafe526e71599ec8575dfd3c0d8012cd8b331f26
Instruction ID: 08ea407a8ab16723a41820844535c96ab8b4b5d3557996751312d4614cb308cd
Opcode Fuzzy Hash: 7398b7e2acad346a2d65205bfafe526e71599ec8575dfd3c0d8012cd8b331f26
Instruction Fuzzy Hash: 5CF0A93121D6E0DB8321D6EAC400922B3A7EB80F14740AD9EE5434AA80EB35F9028786

Uniqueness

Uniqueness Score: -1.00%

Function 05C06DE6, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1facbf4a1ff8c85b66f03d339a8bd3c7bbdc78054eb614bef380a83a5df881cd
Instruction ID: 48178a299beeab67e3cb9faca255de51ce09afbbb709ce48650fb7ce6c029ec8
Opcode Fuzzy Hash: 1facbf4a1ff8c85b66f03d339a8bd3c7bbdc78054eb614bef380a83a5df881cd
Instruction Fuzzy Hash: 45F0E531208710CF8610EFB5E144569B7A3EF892143019D3ED10AC7690CF34AEE68B85

Uniqueness

Uniqueness Score: -1.00%

Function 05C0BD78, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d2111b083b3b92dc1765ffe3d3052ab1516a32311e23b8e88af11b08a81502c
Instruction ID: 6872968775cd2d1ab73afb5324094933fd63bd04d0bfea67eca834913d6ce8d7
Opcode Fuzzy Hash: 1d2111b083b3b92dc1765ffe3d3052ab1516a32311e23b8e88af11b08a81502c
Instruction Fuzzy Hash: 11F08C3080960DEBCB40FFA4E545E9DBF76BB46309F01DA14A400AB264DB309F98CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05C0DFF0, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52178776749baeae18ca5cea978da3a93fa4f4670912b26ab916de7120e3fd79
Instruction ID: d956210ba5f6c72fd1e468237cddcae64b6cb24a489ee6b2c3b5afb8799b5b10
Opcode Fuzzy Hash: 52178776749baeae18ca5cea978da3a93fa4f4670912b26ab916de7120e3fd79
Instruction Fuzzy Hash: 49F03A3105464CEFCB04EF69E46847B7BB9FF41305B409D29F44B462A2DBB5AE81EB81

Uniqueness

Uniqueness Score: -1.00%

Function 05C00BBE, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da4b1b46b5fdf48ced7e34c5e78837b20fc9beb1af819cb8bc0f74df3cac8316
Instruction ID: fd8399f6838c66b0e7ad6e459bf4c1c1845ecd44f59ce2a287f945a750f9223b
Opcode Fuzzy Hash: da4b1b46b5fdf48ced7e34c5e78837b20fc9beb1af819cb8bc0f74df3cac8316
Instruction Fuzzy Hash: D8E0D83170D1648FD715A329E42473837E6EF47328F5608ABD586DB2D2DA95AC0183D6

Uniqueness

Uniqueness Score: -1.00%

Function 05C02480, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c6d423b5c40e78a38ba75496bde419b9a923ac1681e9fd7a88704d053bf669d
Instruction ID: 52d5928f3dd8d6a5e19961aa79f8c6f4715b1bad4fafd764fb01365d6002b211
Opcode Fuzzy Hash: 5c6d423b5c40e78a38ba75496bde419b9a923ac1681e9fd7a88704d053bf669d
Instruction Fuzzy Hash: B0E026353086105B5621D29AD41196E739BCBC5628345CC2EE21ADB380DFA2FD0247D0

Uniqueness

Uniqueness Score: -1.00%

Function 05C0E320, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a28904e24270c655efd04ddb836430cd016ad0bc9e65da93e5a6d1b9448af6
Instruction ID: ea6e236c3238fdd3b5df41c620ea97f37b45f55aaa470f9ae01765ea80cbd53b
Opcode Fuzzy Hash: 60a28904e24270c655efd04ddb836430cd016ad0bc9e65da93e5a6d1b9448af6
Instruction Fuzzy Hash: F2E0ED31684305DB87209FB7541D53A3EBFFB592597047C29D41BE63C1EA249D0486B7

Uniqueness

Uniqueness Score: -1.00%

Function 05C0CFD9, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df906e750fcfc62bc70747dfdcdbfe8a0f83c3e0d14e24682090b6bbe396aa48
Instruction ID: 6e001ed724f740af6e926b5bc3db5fef6bfaa8b190544eeab6b8876ba64d35a4
Opcode Fuzzy Hash: df906e750fcfc62bc70747dfdcdbfe8a0f83c3e0d14e24682090b6bbe396aa48
Instruction Fuzzy Hash: 26F06D3410C219EBC700EF56D540E99B75BFB4060CB01DA12F60ACB5A8D770AE5ECBA3

Uniqueness

Uniqueness Score: -1.00%

Function 05C098C8, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd6f90e8e94cc5ec7252e0f88fdcaf9038f54231a7aaeb038d6dd99b3f1acfb4
Instruction ID: 21c8689062a3652cbe08d570dd87b8499f049760c8f4d1b23767e7a52bb0b430
Opcode Fuzzy Hash: dd6f90e8e94cc5ec7252e0f88fdcaf9038f54231a7aaeb038d6dd99b3f1acfb4
Instruction Fuzzy Hash: EDE0923080920DDBC700FFB4E645E9DBB76BB41309F019A64E604AB264DB305B98CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05C03A18, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c606712a380646e0dccfe30bceed159ecf6007cd4b86bd620a544c63f75e3d46
Instruction ID: ca71ee5b67c02c5d410e031f7966a70dfa05f90f249746931b0ff23db80316ce
Opcode Fuzzy Hash: c606712a380646e0dccfe30bceed159ecf6007cd4b86bd620a544c63f75e3d46
Instruction Fuzzy Hash: FBE04F3121D6F4DB4324D5E7C510832B2A7FA81E14380BD9AE9474AAC0DB75F9428686

Uniqueness

Uniqueness Score: -1.00%

Function 05C0F0F8, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede825ccb24f869c1a370035bfa8efda77ddb59351712d0aaf536e1eacc045e7
Instruction ID: 13e2f9ee607ce92b66cec1535899599793e2eca6558f0ab1cfbcaea1b0b7d7cd
Opcode Fuzzy Hash: ede825ccb24f869c1a370035bfa8efda77ddb59351712d0aaf536e1eacc045e7
Instruction Fuzzy Hash: 9EE0C22078E248ABDB328A32BC11BB33F29D742348F0558CAB90DC60C2D62256A0DA61

Uniqueness

Uniqueness Score: -1.00%

Function 05C0F0B0, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c4f6fce58fa65d1444aa7472028ba605cfef3779a06e8e7a5d032319e990b8
Instruction ID: f10397ebd0d38dfc4313ab935bd6283e16a4de728eb05af29b8c0a3d212510be
Opcode Fuzzy Hash: e8c4f6fce58fa65d1444aa7472028ba605cfef3779a06e8e7a5d032319e990b8
Instruction Fuzzy Hash: 1FE01274D04209EF8B50EFB8DA4559DBBF5FB44205F1085A99909E3340EB309F44DB51

Uniqueness

Uniqueness Score: -1.00%

Function 05C09919, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a36abe74dcec1f67a32c6070e8298320918d1f5145db2beb522356b2b81ecd
Instruction ID: 27fd8d7521f17e57be5e10860abcbae2150f56ab139197d3476ae83a80bd2031
Opcode Fuzzy Hash: 54a36abe74dcec1f67a32c6070e8298320918d1f5145db2beb522356b2b81ecd
Instruction Fuzzy Hash: 14E0263294A208DBD740DFB0DA41BAD77E1EB05208F14095A900CD3550D73A8B40C740

Uniqueness

Uniqueness Score: -1.00%

Function 05C0F0AA, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d11da3c477c4ef576fb53204b32ae69977d3e3595532893f7202d985b8d8def6
Instruction ID: 3ba08e8536c1dde22a4d358c69c90fdd9f44d22f391251b998b81cd09602e365
Opcode Fuzzy Hash: d11da3c477c4ef576fb53204b32ae69977d3e3595532893f7202d985b8d8def6
Instruction Fuzzy Hash: D4E04F35D00108EB8B60EFB8D90115DBAF5EB04204F1044B99D09E3340EA319F10C791

Uniqueness

Uniqueness Score: -1.00%

Function 05C03D61, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515399730bfe55e75d4e82e1af9f7cebe729a73300ebd17db5f04292f2d5bce7
Instruction ID: 8c4787d39ec21199c7bb5ed604de732ecbd291190e60e68dbd2780890d997ddd
Opcode Fuzzy Hash: 515399730bfe55e75d4e82e1af9f7cebe729a73300ebd17db5f04292f2d5bce7
Instruction Fuzzy Hash: 2CF0C930134688EBC758DF11E9689A87B76EB90A05B055826E4178A695CB38BF52CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06AA0788, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbffd1054f2ae485282e553b70a2d76758a6a498d12e708f8d322d018a9fcec9
Instruction ID: 127c4d538b1c40b17bec03282734c6a7ea10067ae8b0d22e99078b145a90c5c9
Opcode Fuzzy Hash: bbffd1054f2ae485282e553b70a2d76758a6a498d12e708f8d322d018a9fcec9
Instruction Fuzzy Hash: 0BE0C23A6006204B93146A15E4145AF73EF9BC8531701432AEC0A83380CF289E4282E1

Uniqueness

Uniqueness Score: -1.00%

Function 05C057B0, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd6d4af3da49c607a2de2c138151ae8449834c8e6359489ad73b5f17ca49962
Instruction ID: 84427c25479dd74e1838482967553b805c082741322c897941a9400f1d96b990
Opcode Fuzzy Hash: 6fd6d4af3da49c607a2de2c138151ae8449834c8e6359489ad73b5f17ca49962
Instruction Fuzzy Hash: DFE04F3012C249CB8604EB0AE980D743377B640209301ED12920686295D7346A55AF92

Uniqueness

Uniqueness Score: -1.00%

Function 05C0C310, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6244d114824868ad2b67829895714e9b15b457c90f4d64f136446abcce5ce820
Instruction ID: 0042a9d9fa0f555e3494b2d1951c26e768c51298e7648961d06599f0f83c18e7
Opcode Fuzzy Hash: 6244d114824868ad2b67829895714e9b15b457c90f4d64f136446abcce5ce820
Instruction Fuzzy Hash: CEE08C3121D685DFC705EFA0E9008D8BF33AA6120530AEB63A651CB6F5E7344E59C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 05C0CFE8, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d99d3bff302ef6d5c32eb22f9a049b785c4137388aa81a7b477950f0f9b768ea
Instruction ID: 2c027d5fc4113638b25bbe793c2e48389a00e9c160c69a79dc79a6e4256fee99
Opcode Fuzzy Hash: d99d3bff302ef6d5c32eb22f9a049b785c4137388aa81a7b477950f0f9b768ea
Instruction Fuzzy Hash: 71E0EC3410C219DB8640FF56E640C697357BB4020D741DE22B60ACB5A8E770AE5FCBA3

Uniqueness

Uniqueness Score: -1.00%

Function 05C09928, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff374325333dc493d3dde27a3b7addb26c28e1f2eec18c12154fec2182dce22
Instruction ID: 5ceb6adb54322a89b9d60db76a1164462b5fd10c58a7c7d72de893e075c6d7b8
Opcode Fuzzy Hash: fff374325333dc493d3dde27a3b7addb26c28e1f2eec18c12154fec2182dce22
Instruction Fuzzy Hash: 18D0C23090A30CEBDB10EFB4D500B9EB7A99705208F015869910DD3250EB308A44C690

Uniqueness

Uniqueness Score: -1.00%

Function 05C00BD8, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7341b028a372ebb1974468d7813432b0de1595a079ff4abbaa4b927d79eaf69
Instruction ID: 9f67572c4c962207f393710dd227992a76722c6282e63a0386c79874f09d6aa0
Opcode Fuzzy Hash: d7341b028a372ebb1974468d7813432b0de1595a079ff4abbaa4b927d79eaf69
Instruction Fuzzy Hash: 6AD05B3131C0249F4704F269942857C32DBDB4A729381189AD507A7390CDD2AC0043D6

Uniqueness

Uniqueness Score: -1.00%

Function 05C06B00, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbe905e0d4cf13620902808277c061d2cde765ac3c258e43c5c0e67864d23054
Instruction ID: 98c1e85662447975036afc88d427f02bbad2c590597d3bd481c2c98590e54966
Opcode Fuzzy Hash: bbe905e0d4cf13620902808277c061d2cde765ac3c258e43c5c0e67864d23054
Instruction Fuzzy Hash: 1CE086F011C10AC79600FF56E940C743767BA40309301DD12A246CA198D7F06EF5EB92

Uniqueness

Uniqueness Score: -1.00%

Function 06AA1410, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a52d675c335e7c2de1d072e8c8f9255586744740742e062d303d2b0c878dc2
Instruction ID: 20801cd24b1471d11756040223e7ccbb9c33ded74c549492a3e00b582a85343d
Opcode Fuzzy Hash: 99a52d675c335e7c2de1d072e8c8f9255586744740742e062d303d2b0c878dc2
Instruction Fuzzy Hash: 3DE0EDB0E40309AFDB84EF6DC404B5E7BF0BF08204F50446AC015DB211D7709901CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05C024C0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 706c6d9651467efc3c5460ed5049d830d187544b97f03e94cb9b31f48b8b801d
Instruction ID: 8b10bb9bc615a882257037bb8f5c193af38fdcb3bc00136b9ac138527f227f6e
Opcode Fuzzy Hash: 706c6d9651467efc3c5460ed5049d830d187544b97f03e94cb9b31f48b8b801d
Instruction Fuzzy Hash: 6BD01239104614CFDB62CBA1E8296217365E704329B10985AD50A8B351D727ED42CA90

Uniqueness

Uniqueness Score: -1.00%

Function 05C0E2EB, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a955374f0e88694261d5630fae396d4f1ec41bd6491f334a20ab7aeee676a48
Instruction ID: df1f987f169e9220f351dd35bc63dfd474d2e92cbfea19677d77664889a5ca7a
Opcode Fuzzy Hash: 7a955374f0e88694261d5630fae396d4f1ec41bd6491f334a20ab7aeee676a48
Instruction Fuzzy Hash: 04E0CD30148574C7D6345F959514079777BFB412153179C69D15745184DB32DC43DB42

Uniqueness

Uniqueness Score: -1.00%

Function 05C07D60, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ad630a9df36408e8eca18a0e0cb23b4a380bd47bd58fb07964e916e5b51420
Instruction ID: 9b68f06a3d1f5264e24025c7ca98fff33e857c7e1edac8083849b93ca263230f
Opcode Fuzzy Hash: b2ad630a9df36408e8eca18a0e0cb23b4a380bd47bd58fb07964e916e5b51420
Instruction Fuzzy Hash: 04E092B0B18284ABCB25CBB8D55445C7FF1DB0A31071049D9D951EF2C2DE349A059746

Uniqueness

Uniqueness Score: -1.00%

Function 05C03D70, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63a78b36d5d8bc88217611dacb18206ae22667171a5dc1a51963a0e7d5ca0bd
Instruction ID: 6f30634e126d08756e22c576c24580a8ae663c606f0b0d51e6ebc51467491cdf
Opcode Fuzzy Hash: b63a78b36d5d8bc88217611dacb18206ae22667171a5dc1a51963a0e7d5ca0bd
Instruction Fuzzy Hash: D6E09A30134688DBC758DF51E5784687B37EB80A417005866F4178AA95CB38AF52DF84

Uniqueness

Uniqueness Score: -1.00%

Function 06AA13D0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 493ec737c0cede5ebd20dbd65b4915212d2f180a6070de481b19dd080b4617ce
Instruction ID: 0d21d1595647d896d524be08fd5ba5b2da7bdf540284ed50170a0474a682b7c0
Opcode Fuzzy Hash: 493ec737c0cede5ebd20dbd65b4915212d2f180a6070de481b19dd080b4617ce
Instruction Fuzzy Hash: E0D05B3615D3807FE7479B516E919B53F235696341B0C4053B08996562C66707158262

Uniqueness

Uniqueness Score: -1.00%

Function 05C0E1E8, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 210641b295fea2d7e12d1d6e0372b9cbe1c67908f7f39c340a75d48f775f3317
Instruction ID: f06c2e256655a03b8599f2472b7360d19f2e9417193d5b75b483e68f105de5ad
Opcode Fuzzy Hash: 210641b295fea2d7e12d1d6e0372b9cbe1c67908f7f39c340a75d48f775f3317
Instruction Fuzzy Hash: EFD067350C8128C7C650D642E508A75772F6760265F00EC57E5161D5E386725AA29A96

Uniqueness

Uniqueness Score: -1.00%

Function 05C05808, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b292927d6170194f810dee02cf1da8c8884f026376deab7b1d412caaca91d5d4
Instruction ID: ff6760caac4ef9e33195a7a00c2407f83c4d5857dd11b781a1bf252d7b7c05cb
Opcode Fuzzy Hash: b292927d6170194f810dee02cf1da8c8884f026376deab7b1d412caaca91d5d4
Instruction Fuzzy Hash: DED05B31558118C78319B7A5F8144F8377AFB426173419E2AD506D7344CF696D10CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 05C0D0FF, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7c71e05e4860d6b997158b0ffce52affaf23f5e7a5ec7470138be6c2092ab83
Instruction ID: 6864ebd5b5bbd684923f15f60fa8b4c99bcb4f9a12ea01a7e28f21ae91257857
Opcode Fuzzy Hash: a7c71e05e4860d6b997158b0ffce52affaf23f5e7a5ec7470138be6c2092ab83
Instruction Fuzzy Hash: 32D09E3014E3846FC3016760AD558977FA9594319C74A5496E0898BAA3C6169968C3B2

Uniqueness

Uniqueness Score: -1.00%

Function 06AA1468, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b63056b2e380a9f35340174f68d09c6b2c5e0ea34343ca42b29b07d8592c64
Instruction ID: 9ce4843637edb4c846b6f015de92c1bbdabd5b3668f5b8fb3942b08d6b9ce3f2
Opcode Fuzzy Hash: e2b63056b2e380a9f35340174f68d09c6b2c5e0ea34343ca42b29b07d8592c64
Instruction Fuzzy Hash: 7DE0ECB0D00309BFDB80EFA8C4117AEBBF4BB08218F10896AC015E7241E77546058F91

Uniqueness

Uniqueness Score: -1.00%

Function 05C0C320, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a836127e5c899b007a613eb1439803a16dff107b7a6b9660eb167ac990fa5df1
Instruction ID: 66196ef7e23b172d6c9bca372dd225e0d3b9b0c72ed487dd646a573c3b139f3c
Opcode Fuzzy Hash: a836127e5c899b007a613eb1439803a16dff107b7a6b9660eb167ac990fa5df1
Instruction Fuzzy Hash: 6DD05E3012C606D68644EB45E501C98B717B640208341BF11A311C61A4DB706E58C697

Uniqueness

Uniqueness Score: -1.00%

Function 05C04CFD, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3acbc22a9a50e83d501744d488f7421f78330d48a9a8b21c51a8f9f8535393f
Instruction ID: 28dbe0dd8227ca97107a301994b777ae0ff6e18aece0576d1b4e9e1215855258
Opcode Fuzzy Hash: b3acbc22a9a50e83d501744d488f7421f78330d48a9a8b21c51a8f9f8535393f
Instruction Fuzzy Hash: 0ED0C735F04204C78F1896F5E4940EEB332EBD1119B1048AAD61557284DB359816C740

Uniqueness

Uniqueness Score: -1.00%

Function 05C07DB7, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d9430d9c52f4396fd75e2fdf19a21280827984e39d971075723a2dcc58ed32
Instruction ID: f71aa8f8d34094b1b3adc405e86d26fd055acd2496a3fddd493dd35ba793543c
Opcode Fuzzy Hash: a9d9430d9c52f4396fd75e2fdf19a21280827984e39d971075723a2dcc58ed32
Instruction Fuzzy Hash: F8D01239155200B9FB0383816E06FB02B63D704305F240506F14D695D0C75911124A84

Uniqueness

Uniqueness Score: -1.00%

Function 05C024D0, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b30a4def2d9b1c50c51c54154af4bad3aee2ad7ed3261564c781a03213daa6
Instruction ID: 84b8ea5286a5725df39df357504099a910996a3f75fcfe11c0ae2eeb45a58507
Opcode Fuzzy Hash: 74b30a4def2d9b1c50c51c54154af4bad3aee2ad7ed3261564c781a03213daa6
Instruction Fuzzy Hash: B3D01238108604CB8E64DBE2D85C4357366E748329310AC99D00F4B391D633EC83CB40

Uniqueness

Uniqueness Score: -1.00%

Function 065C0F38, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509106767.00000000065C0000.00000040.00000001.sdmp, Offset: 065B0000, based on PE: true

Associated: 0000000C.00000002.509088108.00000000065B0000.00000004.00000001.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781955b3b27f8f08b07fed547c20aaf1e726e0113efcd15939e27a16b067fb8c
Instruction ID: bfda31082cff57310b3e15cc1d11c5499a2195991a8c465059300f251135c105
Opcode Fuzzy Hash: 781955b3b27f8f08b07fed547c20aaf1e726e0113efcd15939e27a16b067fb8c
Instruction Fuzzy Hash: B9C08C7026C204DFEB8CA6956894972339BF3C9710B00CD28B60E021C5CAB268806088

Uniqueness

Uniqueness Score: -1.00%

Function 06AA13E0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.509273134.0000000006AA0000.00000040.00000001.sdmp, Offset: 06AA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36be9f5739433ce725a24f9c6b660b43bd36093fb1a4d540140cac67d2466196
Instruction ID: 9738ddc1667934ae9f51be1055b1a9685c1a5efe05e6da0178151537c1bdc4e9
Opcode Fuzzy Hash: 36be9f5739433ce725a24f9c6b660b43bd36093fb1a4d540140cac67d2466196
Instruction Fuzzy Hash: 6EC08C31228304BBEB88FE55A99096673BBA7CC701F04C01AB10F176888FB16D0001E5

Uniqueness

Uniqueness Score: -1.00%

Function 05C0F108, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b85ec0a03aa952949f9ac4da112ea01727630f5814a7138866e4bf11c9dd73d
Instruction ID: 62f8c53059aac673b71cd64094e44a80b3ee29d9a2e761c5b17a5aa99602b1ed
Opcode Fuzzy Hash: 5b85ec0a03aa952949f9ac4da112ea01727630f5814a7138866e4bf11c9dd73d
Instruction Fuzzy Hash: B7C0922028C208E2E430D983F81BB34724BA344F45F402C0AB60F546C509C124A09C6B

Uniqueness

Uniqueness Score: -1.00%

Function 05C0F298, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2821a46f87066c04f59cedb3f8f01a7c7f1dac34d1583ffd33592c7f6249e4f4
Instruction ID: 391968828eb11847630ba44d5e42bc3611b17cf2d6d1f5d59378b04f89c534cd
Opcode Fuzzy Hash: 2821a46f87066c04f59cedb3f8f01a7c7f1dac34d1583ffd33592c7f6249e4f4
Instruction Fuzzy Hash: DBB0923136420D0BEA7097F67804766338CA780A58F410466B80CC1A40E58AE9A04040

Uniqueness

Uniqueness Score: -1.00%

Function 05C07DC8, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5312caebd8a72bf8948408c533d4866aefac18a764bea5bf11640ff714fcc6c
Instruction ID: e580ff25d3afb196ad89d5171666b43b9efc1fe3ebdc0029b4593a0096510d33
Opcode Fuzzy Hash: d5312caebd8a72bf8948408c533d4866aefac18a764bea5bf11640ff714fcc6c
Instruction Fuzzy Hash: A0C0923538C309E2ED1CD2C32D0AF7536CBD308B05E002C13B60F588D0098978124756

Uniqueness

Uniqueness Score: -1.00%

Function 05C07F58, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2e00b5e9b191a9b6666a523d20564bd7c09714e729520e9a9efa7d599241cd
Instruction ID: c040ffc14e801bcac23bbae7ea37c6a20f50404c938f63476b3bf1e54e515013
Opcode Fuzzy Hash: ed2e00b5e9b191a9b6666a523d20564bd7c09714e729520e9a9efa7d599241cd
Instruction Fuzzy Hash: 45B092313542090AEA6497B5794872637CCD740A18F40046AB40CC1A41E59AF8A20040

Uniqueness

Uniqueness Score: -1.00%

Function 05C0D110, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 237e057ac46393141fbb41a7274bed34d2857627dcc6554f11f4ca572a458c04
Instruction ID: e5345af6fd7e6e20caf249fb368bef6702ad8fca40f44f6f3e1abc6d0ed9e2fe
Opcode Fuzzy Hash: 237e057ac46393141fbb41a7274bed34d2857627dcc6554f11f4ca572a458c04
Instruction Fuzzy Hash: 7DB092302452088E4344A7D4950C85AB7E95A11668389E495D50E4FAA29B21EC68D6A1

Uniqueness

Uniqueness Score: -1.00%

Function 05C06C5C, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1502b6e15bafcdd3420eb1db53eda2ff2532c4fbeb5d3959acb56bca0a6b6d35
Instruction ID: d6f1e38419b35efdc2f195856a3f8fff6011805fae303cdf6e6ed44e74607f21
Opcode Fuzzy Hash: 1502b6e15bafcdd3420eb1db53eda2ff2532c4fbeb5d3959acb56bca0a6b6d35
Instruction Fuzzy Hash: 8FC08C34148030AB820AFB21E1120AC23A3A6802023C18E24F003970C0CF6C0EC98386

Uniqueness

Uniqueness Score: -1.00%

Function 05C00991, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a2ea0c7a788a6a274ba246eb69221774b4b44d3d8e4a5bbd9749ddaf3eeac3
Instruction ID: 7b5595710db165df4ec98d6d5e8babaf03594e27ab1b7a010af23041c1058e6c
Opcode Fuzzy Hash: a2a2ea0c7a788a6a274ba246eb69221774b4b44d3d8e4a5bbd9749ddaf3eeac3
Instruction Fuzzy Hash: 91C08C30401200DFDF27CB20E464B1037A2FB00301F108168C00686210CB3C4810CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 05C014C0, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e892b2e6e4b85a39e43844f00d3dee4cb7199330fea94ab098658688fe0e293d
Instruction ID: ff6ca04f4c74fe4824b539f8a5f1f83fe2aa5444343603224e5cfc2ae3889dd9
Opcode Fuzzy Hash: e892b2e6e4b85a39e43844f00d3dee4cb7199330fea94ab098658688fe0e293d
Instruction Fuzzy Hash: 25B0923400CA149BC1A1EB63EE45D59B66FE9012067459910E202850A96F686E8886A6

Uniqueness

Uniqueness Score: -1.00%

Function 05C0E36F, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.508614197.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27cacc28d6e95442dae673830c9abafab2303994cfaf48d54474e6486a48c3bb
Instruction ID: 09f2ca5e3d3f832ca22f9068aa019dbc13ced1522b7b4678249cc8c26392b532
Opcode Fuzzy Hash: 27cacc28d6e95442dae673830c9abafab2303994cfaf48d54474e6486a48c3bb
Instruction Fuzzy Hash: E4B0122434A21497470042F2401812D2546CB1C5227082C111403823C0DA34C8000100

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: lkjhgfs.exe PID: 1848 Parent PID: 3472 lkjhgfs.exeCOMMON

Executed Functions

Function 0533C718, Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,?,?), ref: 0533C7BF

Memory Dump Source

Source File: 0000000F.00000002.492924950.0000000005330000.00000040.00000001.sdmp, Offset: 05330000, based on PE: false

Similarity

API ID: ChildEnumWindows
String ID:
API String ID: 3555792229-0
Opcode ID: 812733c13ae4bfe60fbf2842e297cbbd596632182916c84f4f960a41510a3170
Instruction ID: e7f91367b6a85beb4d6f483f5bc01cdc306a7f1652b3f41db481377fa55a2181
Opcode Fuzzy Hash: 812733c13ae4bfe60fbf2842e297cbbd596632182916c84f4f960a41510a3170
Instruction Fuzzy Hash: A031BBB4D05258DFCB14CFA9E584AEEFBB1AF59314F24A02AE804B7250C774A945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0533AD28, Relevance: 1.8, APIs: 1, Instructions: 321processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0533AFEF

Memory Dump Source

Source File: 0000000F.00000002.492924950.0000000005330000.00000040.00000001.sdmp, Offset: 05330000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f525b0ded46479e62026ffe28c6d2d98dbd3a776cb49bb844ff089c1f2280558
Instruction ID: 0aedf30c5686f940474b5f2223b737c1e4910521543d415b8983810ad891ee35
Opcode Fuzzy Hash: f525b0ded46479e62026ffe28c6d2d98dbd3a776cb49bb844ff089c1f2280558
Instruction Fuzzy Hash: ADC12471D0426D8FCB20CFA4C851BEDBBB1BF49304F0196A9E559B7240DBB49A89CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0533BE30, Relevance: 1.7, APIs: 1, Instructions: 158COMMON

Download Yara Rule

APIs

K32GetModuleBaseNameA.KERNEL32(?,?,?,?), ref: 0533BF9F

Memory Dump Source

Source File: 0000000F.00000002.492924950.0000000005330000.00000040.00000001.sdmp, Offset: 05330000, based on PE: false

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: 72da6030636f26b1c82fb806e52eb05087935dfa283d977fa98813f58dd0fe55
Instruction ID: 8f7a8dce793fc604b5ecc00394803239147cd6ecc30833c78a8b8a27ce9e192a
Opcode Fuzzy Hash: 72da6030636f26b1c82fb806e52eb05087935dfa283d977fa98813f58dd0fe55
Instruction Fuzzy Hash: C361CCB4D042589FCB24CFA9D885B9EFBB1BF49304F10912AE819AB350DB74A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0533AA70, Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0533AB43

Memory Dump Source

Source File: 0000000F.00000002.492924950.0000000005330000.00000040.00000001.sdmp, Offset: 05330000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 11334556eef1bfc720c36f478a29912a597bc040c5a211437833504070e3ef9c
Instruction ID: 4f2ad9c369be38b873bc2690c3896a45158085add41801b529ebb57d32faea89
Opcode Fuzzy Hash: 11334556eef1bfc720c36f478a29912a597bc040c5a211437833504070e3ef9c
Instruction Fuzzy Hash: 9841B8B4D052589FCF00CFA9D984AEEFBF1BB49314F14902AE818B7200D774AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05336D39, Relevance: 1.6, APIs: 1, Instructions: 109fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 05336E16

Memory Dump Source

Source File: 0000000F.00000002.492924950.0000000005330000.00000040.00000001.sdmp, Offset: 05330000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: ba5a89d5bf54397c3f9eb346612e8890eff3f717c3dd1628bbbd92fc763af3b8
Instruction ID: aa36fd70ceec2215b4ddd7eae7787f223d2db04e7aa69dd5e1a8602b7953a08f
Opcode Fuzzy Hash: ba5a89d5bf54397c3f9eb346612e8890eff3f717c3dd1628bbbd92fc763af3b8
Instruction Fuzzy Hash: 6441CDB5D04258DFCB10CFAAD585AEEFBF1BB49314F14802AE458B7260D374A989CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05336D40, Relevance: 1.6, APIs: 1, Instructions: 107fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 05336E16

Memory Dump Source

Source File: 0000000F.00000002.492924950.0000000005330000.00000040.00000001.sdmp, Offset: 05330000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 38b4d8976bdefd4e3d62643fda7149782b79133f78dec1a1218ffd2e26154016
Instruction ID: 6ecb8066dfc9bb4908a10930002b0e6b7ac1e5814ac06a56ccfd09341a51fcb1
Opcode Fuzzy Hash: 38b4d8976bdefd4e3d62643fda7149782b79133f78dec1a1218ffd2e26154016
Instruction Fuzzy Hash: 7941CCB4D04258DFCB10CFAAD585AEEFBF1BB49314F14802AE458B7260D374A989CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0533A920, Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0533A9CA

Memory Dump Source

Source File: 0000000F.00000002.492924950.0000000005330000.00000040.00000001.sdmp, Offset: 05330000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3f4b9086f4278fd030ff4256107a51ca293ecc1d1ec2e4058b979a20e468818c
Instruction ID: d0b0afbec97ab8989997ea279c069a825df641842476108764b03c8fc7bdff0a
Opcode Fuzzy Hash: 3f4b9086f4278fd030ff4256107a51ca293ecc1d1ec2e4058b979a20e468818c
Instruction Fuzzy Hash: 173197B8D042589FCF10CFA9D984ADEBBB1BB49314F10A42AE815B7310D735A946CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05051559, Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05051604

Memory Dump Source

Source File: 0000000F.00000002.492507825.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: beb026c2d28b68f5b3cfd88e0b97f67859b2580bd542ce0dea2d745be831b7d2
Instruction ID: b7844751636b5e10255ea20d52495902e9bb5977c8015045eeeff940894c321c
Opcode Fuzzy Hash: beb026c2d28b68f5b3cfd88e0b97f67859b2580bd542ce0dea2d745be831b7d2
Instruction Fuzzy Hash: 3A31A9B4D04258DFCF10CFA9E984ADEFBB1BB49314F14902AE815B7210D775A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0533B5A8, Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?), ref: 0533B668

Memory Dump Source

Source File: 0000000F.00000002.492924950.0000000005330000.00000040.00000001.sdmp, Offset: 05330000, based on PE: false

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 6e1cc499dc06472c30627ad3a91b85de9e4483ce9b345292ebe233b7f811d672
Instruction ID: a42dc0b036733175a6390891c06a54b82eb4843cf4c93c8fa68b48fac8278ea0
Opcode Fuzzy Hash: 6e1cc499dc06472c30627ad3a91b85de9e4483ce9b345292ebe233b7f811d672
Instruction Fuzzy Hash: F04188B4D04258DFCB10CFAAD984ADEFBF1BB49314F14902AE458B7210D775A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0533BC70, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,?,?,?), ref: 0533BD16

Memory Dump Source

Source File: 0000000F.00000002.492924950.0000000005330000.00000040.00000001.sdmp, Offset: 05330000, based on PE: false

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: dbf272a9e26b0044eed0cd113cfbca8510376f67ba172db0c1234dd89e430e29
Instruction ID: bbfa0cbbc761a8e7383d40d5bd56987df33f78b2b3580f86884aa09a52aadcf4
Opcode Fuzzy Hash: dbf272a9e26b0044eed0cd113cfbca8510376f67ba172db0c1234dd89e430e29
Instruction Fuzzy Hash: 203197B8D042589FCF10CFA9D984ADEFBB0BB09314F14902AE814B7310D374A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05051560, Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05051604

Memory Dump Source

Source File: 0000000F.00000002.492507825.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6643e9eaf5f264a32f351cca3d4f74e42b761a216a53d770c279cb7ab29b5f8b
Instruction ID: 6aec0beab4009f1f3127c11a8dcef3a4b586158816328bc81392a7239931a5bf
Opcode Fuzzy Hash: 6643e9eaf5f264a32f351cca3d4f74e42b761a216a53d770c279cb7ab29b5f8b
Instruction Fuzzy Hash: C331A8B4D042589FCF10CFA9D984ADEFBB1BB49314F14902AE814B7210D735A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0533A768, Relevance: 1.6, APIs: 1, Instructions: 94threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,?), ref: 0533A817

Memory Dump Source

Source File: 0000000F.00000002.492924950.0000000005330000.00000040.00000001.sdmp, Offset: 05330000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: bacf8d40bce15a625b71e13b76af3932e2b7bc6fe64af09940e415bbe7e1ad85
Instruction ID: b0d1fb54b1a4186ab16244c0d210a2aaffb04f3c4add2d3b7911e412d63720da
Opcode Fuzzy Hash: bacf8d40bce15a625b71e13b76af3932e2b7bc6fe64af09940e415bbe7e1ad85
Instruction Fuzzy Hash: D031ACB4D05258DFCB10CFAAD984AEEBBF1BF49314F14802AE459B7240D778A985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05051828, Relevance: 1.6, APIs: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 050518AE

Memory Dump Source

Source File: 0000000F.00000002.492507825.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0ad406479adc191e37192d2ddb820825994fd9ad7a201ea87bfcaa9c582b27b6
Instruction ID: 011233007729adb5dd7ee0bc3fd208053c32280dfb47eae6ce6766963c55e7df
Opcode Fuzzy Hash: 0ad406479adc191e37192d2ddb820825994fd9ad7a201ea87bfcaa9c582b27b6
Instruction Fuzzy Hash: D031BCB4D042589FCB10CFA9E984AAEFBB5BB48324F14842AE815B7310D774A845CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05051830, Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 050518AE

Memory Dump Source

Source File: 0000000F.00000002.492507825.0000000005050000.00000040.00000001.sdmp, Offset: 05050000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 39e41ad0a28964b6e9b6e3c0782fde0c5b02d0e8eddc31090b9daee77ce8d963
Instruction ID: 278ee10949bad03c17bc53bb9b170ec721b8a8a3d4dbdff9ffb26f4b2a3dde56
Opcode Fuzzy Hash: 39e41ad0a28964b6e9b6e3c0782fde0c5b02d0e8eddc31090b9daee77ce8d963
Instruction Fuzzy Hash: AA31CBB4D042589FCB10CFA9E584AEEFBB5BB48324F14802AE815B7300C734A845CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0533C110, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0533C18D

Memory Dump Source

Source File: 0000000F.00000002.492924950.0000000005330000.00000040.00000001.sdmp, Offset: 05330000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 40045e4a26d072ab9470180fc0c75bea1c46e557b88ea8aa78b88b6400c1a9ea
Instruction ID: 2d342f69db85b669390424775b06bf88926c8eae3fd72aed21a971eb3fcc4882
Opcode Fuzzy Hash: 40045e4a26d072ab9470180fc0c75bea1c46e557b88ea8aa78b88b6400c1a9ea
Instruction Fuzzy Hash: FA3198B4D092589FCB10CFA9D984AEEFBB4AB09314F14906AE815B7310C774A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 011F2B10, Relevance: 1.6, APIs: 1, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 011F2B57

Memory Dump Source

Source File: 0000000F.00000002.486560067.00000000011F0000.00000040.00000001.sdmp, Offset: 011F0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f914ca23c03ed3e5627661734ec13b8072f7d3cb752a32bde89e2ee8d91b10a3
Instruction ID: cd57c2527fe24bc048603179d6365335416dc74de749c395fc93e42cffaed28f
Opcode Fuzzy Hash: f914ca23c03ed3e5627661734ec13b8072f7d3cb752a32bde89e2ee8d91b10a3
Instruction Fuzzy Hash: 5F118B30B042088FCB18DF78C458AADBBF1AF89704B2504ADE802EB761DB71CC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 011F2B20, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 011F2B57

Memory Dump Source

Source File: 0000000F.00000002.486560067.00000000011F0000.00000040.00000001.sdmp, Offset: 011F0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dd849570d5554ecb90ade88b43113acf0d8669ef9cf0e2ecf0b4f792f38746f8
Instruction ID: c4da6f8dde501e8d24752a4c1a995604e2b2c9aaed22cba48c99cf9123201225
Opcode Fuzzy Hash: dd849570d5554ecb90ade88b43113acf0d8669ef9cf0e2ecf0b4f792f38746f8
Instruction Fuzzy Hash: 7E112730B00518CFCB58DF69C558AADBBF6AF89614B220469E506EB760DB71DC418BA2

Uniqueness

Uniqueness Score: -1.00%

Function 011F2BE9, Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 011F2B57

Memory Dump Source

Source File: 0000000F.00000002.486560067.00000000011F0000.00000040.00000001.sdmp, Offset: 011F0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2058e312753237a5993ab59b2d0abb5d364d39b8aaadc4de2173790698bc627d
Instruction ID: 288e9966139b863905ad61f01334122a9d65f36592da1336eec66a47b0939ae2
Opcode Fuzzy Hash: 2058e312753237a5993ab59b2d0abb5d364d39b8aaadc4de2173790698bc627d
Instruction Fuzzy Hash: 57118E30B00119CFCB58DFA8C149AAD7BF1AF89314B2244ADD506EB761CB71CC42CB52

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: lkjhgfs.exe PID: 5188 Parent PID: 3472 lkjhgfs.exeCOMMON

Executed Functions

Function 050A5630, Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

mt<", xrefs: 050A57E7

Memory Dump Source

Source File: 00000011.00000002.505441769.00000000050A0000.00000040.00000001.sdmp, Offset: 050A0000, based on PE: false

Similarity

API ID:
String ID: mt<"
API String ID: 0-493029461
Opcode ID: 6e8c77ced5fdd96614fcf197d5ff5292328df539eefeca87b2ac0e45bde195d1
Instruction ID: 6a92a7d74d4e1a81a3b4e8e42e5aa40e8ae738be0045f88687ffc10db70335d7
Opcode Fuzzy Hash: 6e8c77ced5fdd96614fcf197d5ff5292328df539eefeca87b2ac0e45bde195d1
Instruction Fuzzy Hash: E991F075D09218CFDF14CFA9E885BADBBF6BB89310F10956AD809AB355EB305885CF10

Uniqueness

Uniqueness Score: -1.00%

Function 050A562F, Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

mt<", xrefs: 050A57E7

Memory Dump Source

Source File: 00000011.00000002.505441769.00000000050A0000.00000040.00000001.sdmp, Offset: 050A0000, based on PE: false

Similarity

API ID:
String ID: mt<"
API String ID: 0-493029461
Opcode ID: 4204429a3517eeebf875a63ec938e83fffaba4a38191ac694ec00be457a3cbc5
Instruction ID: aafad3fe3aecbc290c938d014d33b43aa0f9a882dee7495ae00ad3cb9ae45548
Opcode Fuzzy Hash: 4204429a3517eeebf875a63ec938e83fffaba4a38191ac694ec00be457a3cbc5
Instruction Fuzzy Hash: 2881F175E09218CFDF54CFA9E885AADBBF2BF89310F10956AD409AB355EB305885CF10

Uniqueness

Uniqueness Score: -1.00%

Function 02911559, Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02911604

Memory Dump Source

Source File: 00000011.00000002.498750727.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: adc4bb513ac655aff9469da1914c15ee9eccddaeefa653c4db056e6278c12ce3
Instruction ID: 2e242f0d3dd89bb2859374f3f8d550544b22f53bdc4efc491e9241c6d8aca6a4
Opcode Fuzzy Hash: adc4bb513ac655aff9469da1914c15ee9eccddaeefa653c4db056e6278c12ce3
Instruction Fuzzy Hash: FE31A8B4D04258DFCF10CFA9D984ADEFBB1BB49314F14942AE819B7210D735A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02911560, Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02911604

Memory Dump Source

Source File: 00000011.00000002.498750727.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8a9d35a3ea5ccbd3a4bab98d37c613d1865ef4bbf3ea7c2f19d43bf87458008d
Instruction ID: ae4e803e729daf9e50d0c341b28f1e7d39b572cb6f6552f3581a3a226607bd59
Opcode Fuzzy Hash: 8a9d35a3ea5ccbd3a4bab98d37c613d1865ef4bbf3ea7c2f19d43bf87458008d
Instruction Fuzzy Hash: 5831A7B4D04258EFCF10CFAAD984ADEFBB1BB49314F14942AE918B7210D735A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02911828, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 029118AE

Memory Dump Source

Source File: 00000011.00000002.498750727.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 1693e479b2ca468a975c49cf5b2f0826274f36368682a923106bf46a421f092a
Instruction ID: e8b156b2df5ce9158744edcce5c91c63c549ed6014272a0758a4e55e6d762e05
Opcode Fuzzy Hash: 1693e479b2ca468a975c49cf5b2f0826274f36368682a923106bf46a421f092a
Instruction Fuzzy Hash: E031BAB4D042589FCB10CFAAD984ADEFBB5AB48314F14842AE918B7310D734A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02911830, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 029118AE

Memory Dump Source

Source File: 00000011.00000002.498750727.0000000002910000.00000040.00000001.sdmp, Offset: 02910000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 0b3ec8c13ba8836cc724fb11bff002c0a48329a72b3f62f6241033b88759292d
Instruction ID: 6c7eb13fc2c218d17196d1df0b6247ce70dd6b0528910c6d2bc620207e927655
Opcode Fuzzy Hash: 0b3ec8c13ba8836cc724fb11bff002c0a48329a72b3f62f6241033b88759292d
Instruction Fuzzy Hash: 4631CBB4D042589FCF10CFAAD984ADEFBB4AB49314F14842AE918B7300C734A845CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01032B10, Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01032B57

Memory Dump Source

Source File: 00000011.00000002.498469623.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c30710069aaea76529e610f2bad7a9a91f99edb2024abcbb9afbdfb18085c406
Instruction ID: 55d4c4c16ee557a770bb285096baee803a32234ad76a0954c58fbf3d6a101755
Opcode Fuzzy Hash: c30710069aaea76529e610f2bad7a9a91f99edb2024abcbb9afbdfb18085c406
Instruction Fuzzy Hash: 49115530B04114CFCB18DF68C458AADBBF6AFD9714B2104A9E042EB761DB719C418B91

Uniqueness

Uniqueness Score: -1.00%

Function 01032B20, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01032B57

Memory Dump Source

Source File: 00000011.00000002.498469623.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aeac3eb2ef38504d785c2a3fc7f1248f7793fad9967b555dba93456092b68a3e
Instruction ID: f51744d5c9541854ccb59794539594632853e6fabb2c07fa0b6bbd155765223d
Opcode Fuzzy Hash: aeac3eb2ef38504d785c2a3fc7f1248f7793fad9967b555dba93456092b68a3e
Instruction Fuzzy Hash: C2113930B04114CFCB58DF69C458AADBBFAAFC9714B2104A9E046EB760CB71DC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01032BE9, Relevance: 1.5, APIs: 1, Instructions: 42libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01032B57

Memory Dump Source

Source File: 00000011.00000002.498469623.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f21cabcbbd524486303c951c382774d96701746b526b7b8d2cc176b7ce317ef3
Instruction ID: a31bd16a37dbdf26d7f285c35b3b166481762ba896e47c18be8e3fba14049671
Opcode Fuzzy Hash: f21cabcbbd524486303c951c382774d96701746b526b7b8d2cc176b7ce317ef3
Instruction Fuzzy Hash: 86014830B44115CFC748DF68C958AADBBF9AF88314B250469D402EF361CB719C41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B9D644, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.497176120.0000000000B9D000.00000040.00000001.sdmp, Offset: 00B9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2bc216888dbdf0c6efa0ce1e3625518ddeef8b2ad61e7a4a6aa1cd0fa715ce
Instruction ID: e915f4fa81dbaecfc500e125e878cc794815e321e074526ec7b1902ed23f86da
Opcode Fuzzy Hash: ee2bc216888dbdf0c6efa0ce1e3625518ddeef8b2ad61e7a4a6aa1cd0fa715ce
Instruction Fuzzy Hash: 1B2137B6504244DFDF00CF50D9C0B26BFA5FB88324F2485B9E9094B246C33ADC56DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B9D63F, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.497176120.0000000000B9D000.00000040.00000001.sdmp, Offset: 00B9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6866c8b08434bdbd5fa1578fb5b946e87ca1ac65ff923eebbf5c9b940695a3d8
Instruction ID: 29a31d355af76a755aecd3d5ff7d0db6c74507b908d5e51855587b488438574a
Opcode Fuzzy Hash: 6866c8b08434bdbd5fa1578fb5b946e87ca1ac65ff923eebbf5c9b940695a3d8
Instruction Fuzzy Hash: 0011AF76804280DFCF11CF50D9C4B16BFB1FB84324F2486A9D9494B656C33AD85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 050A103C, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.505441769.00000000050A0000.00000040.00000001.sdmp, Offset: 050A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0e4566a644e58c4f709aa179144f56ca47cc8382c6acfbb7d41cf5298f0605
Instruction ID: 3be632e32bdb338f1f4f0e5e3f45bc8d19581936c514838c2dde7e7775fe6390
Opcode Fuzzy Hash: db0e4566a644e58c4f709aa179144f56ca47cc8382c6acfbb7d41cf5298f0605
Instruction Fuzzy Hash: 8A21B0B5D04228CFDB60CFA4D898BEDBBB1BB09305F1485DAD509A3290DB745AC5CF15

Uniqueness

Uniqueness Score: -1.00%

Function 050A5979, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.505441769.00000000050A0000.00000040.00000001.sdmp, Offset: 050A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 618e448cb7ed06318c3b69dff1984ca8d8aaaedf1d4baf092b56e26532204c1e
Instruction ID: ecb6a3766c14faa3b22dcee7fa5631653b9c88b655e789e0c27b9e40f06b96e8
Opcode Fuzzy Hash: 618e448cb7ed06318c3b69dff1984ca8d8aaaedf1d4baf092b56e26532204c1e
Instruction Fuzzy Hash: E4F08C74E09208DFCF50CFA4EA596ADBBF1FB49200F1180EAD80997321D6309A0ACF01

Uniqueness

Uniqueness Score: -1.00%

Function 050A59C8, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.505441769.00000000050A0000.00000040.00000001.sdmp, Offset: 050A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f432e0d218fa2a424b81eba228e8b794628aeeedcf7964a14744feb1b53f8ed6
Instruction ID: 5c9f2aa59adf95f22a978345d8a3aa01e66afc4ad11a1a5fef61472aae6d7fff
Opcode Fuzzy Hash: f432e0d218fa2a424b81eba228e8b794628aeeedcf7964a14744feb1b53f8ed6
Instruction Fuzzy Hash: 6CE03971D09208DBCF20DBA8AA002ADBBF6FB49205F1081AAC809A6714E7314A45CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050A55D1, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.505441769.00000000050A0000.00000040.00000001.sdmp, Offset: 050A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f22e63f4f8d1ee3cbaf1fb69ec6e326b592cefd06eb9f695f02486dc9712ff
Instruction ID: 244269e63bc4a69aa431f9718457bcefe8c9c14ef819e90e227ad1246a8c9409
Opcode Fuzzy Hash: f1f22e63f4f8d1ee3cbaf1fb69ec6e326b592cefd06eb9f695f02486dc9712ff
Instruction Fuzzy Hash: 3CE03972E05108DFCB41DFE8E9506ACBBF2FB88204F20C099981993300DA318A02CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050A0781, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.505441769.00000000050A0000.00000040.00000001.sdmp, Offset: 050A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f2a4a348e19cd74664f1ef7bd992c4872d6b78297a17c677b32333882c16a7
Instruction ID: 8bac6e3e40dcf6a05fc142516690f619a50ce15ac8144f5b203a50f1e0e715c9
Opcode Fuzzy Hash: b2f2a4a348e19cd74664f1ef7bd992c4872d6b78297a17c677b32333882c16a7
Instruction Fuzzy Hash: D3F0B2B5904228CBDBA08F90DC99B9CBBB2BB05301F0444DAD609B3250CF745EC5CF15

Uniqueness

Uniqueness Score: -1.00%

Function 050A5A19, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.505441769.00000000050A0000.00000040.00000001.sdmp, Offset: 050A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708598df114268e6414c41b81d1af16e97f68177b3922670be7da172195b30b5
Instruction ID: 9532f93db930f0a7f02e010a9155184368a9a64fc3a8c9eed6af717f7319e49d
Opcode Fuzzy Hash: 708598df114268e6414c41b81d1af16e97f68177b3922670be7da172195b30b5
Instruction Fuzzy Hash: 30E0927090A284DFCB51DFF4995129D7FF5BB19205F6400E9C40897212E6358A49CB50

Uniqueness

Uniqueness Score: -1.00%

Function 050A55DF, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.505441769.00000000050A0000.00000040.00000001.sdmp, Offset: 050A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e754c67cbf332321c61ecb1ee57f395d3f173ace31c4c9e9ab81f042c31e704d
Instruction ID: 339d20a40a5aa42637b5c661a2f8fb4058551ac63e8fe9a0cf21b98770d8f776
Opcode Fuzzy Hash: e754c67cbf332321c61ecb1ee57f395d3f173ace31c4c9e9ab81f042c31e704d
Instruction Fuzzy Hash: 55E0C974D49208AFCB54DFE8D95169CBBF1FB49204F1481A9D81993341D6315A45CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050A55E0, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.505441769.00000000050A0000.00000040.00000001.sdmp, Offset: 050A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3148d44614085fc5ef3d0232d3761c75fdfe90de814d22c80287189a20f306b
Instruction ID: 02ac5f51d34d9937ce6836a596c1e5b8be5c04e2867b7fbf8befa104fc4b4c1d
Opcode Fuzzy Hash: d3148d44614085fc5ef3d0232d3761c75fdfe90de814d22c80287189a20f306b
Instruction Fuzzy Hash: 5AE0E574E09208EFCB84DFE8E9516ACBBF5FB88204F10C0A9981993341DA319A41CF80

Uniqueness

Uniqueness Score: -1.00%

Function 050A59D7, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.505441769.00000000050A0000.00000040.00000001.sdmp, Offset: 050A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f1bb0aa73dcd39fc3f5ab8a5be75593e55055b8eed4c1cf37591479007da93
Instruction ID: ef97df0901bbc20bab0fbfe9e0a122e504bb4752909a8097ccc29a5f8588f26e
Opcode Fuzzy Hash: 14f1bb0aa73dcd39fc3f5ab8a5be75593e55055b8eed4c1cf37591479007da93
Instruction Fuzzy Hash: 21E0E534D49208EECF54DFA8E94069DBBF1EB49204F1082A9C809A7710D7354A44CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050A5A28, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.505441769.00000000050A0000.00000040.00000001.sdmp, Offset: 050A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04505ff357c3410d2c2132480d25ffa7b7d39174bd94849b8d7c6c68a7ff5b4
Instruction ID: 8fc919acc103d75d795da6473e24dd750bd7136363486ee8f17ef5964a6108c9
Opcode Fuzzy Hash: d04505ff357c3410d2c2132480d25ffa7b7d39174bd94849b8d7c6c68a7ff5b4
Instruction Fuzzy Hash: 0FE08C30909348DFCB44EFF8E84169CBBF9AB08204F2000A8880893300EB709A80CB80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: RegAsm.exe PID: 964 Parent PID: 1848 RegAsm.exeCOMMON

Executed Functions

Function 053017E0, Relevance: 2.0, APIs: 1, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.502625738.0000000005300000.00000040.00000001.sdmp, Offset: 05300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dac5bc0e674cd629f3850b01bc92032e3da04ce6e14d6fdb035fa549b69d5a7
Instruction ID: 88fb5136cb8b1159e5577d71e7e80346e69584dc68395df0756171f7d09762bb
Opcode Fuzzy Hash: 7dac5bc0e674cd629f3850b01bc92032e3da04ce6e14d6fdb035fa549b69d5a7
Instruction Fuzzy Hash: E4228178E04305CFCB14DB98D8A8ABFBBB6FB89310F649156E402677D4C774A885CB61

Uniqueness

Uniqueness Score: -1.00%

Function 053045F4, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 053046B1

Memory Dump Source

Source File: 00000017.00000002.502625738.0000000005300000.00000040.00000001.sdmp, Offset: 05300000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 58a052dffaeeacc3ee36e362c7f9389f54cc802628353fcad4299b3ce90904c5
Instruction ID: d21038db22415b4791061fd93d7127df4caf9f89e5bdd41014f87489e1dccf7e
Opcode Fuzzy Hash: 58a052dffaeeacc3ee36e362c7f9389f54cc802628353fcad4299b3ce90904c5
Instruction Fuzzy Hash: B841EF71C04358CBDB24CFA9C984B9EBBB1BF49304F25805AD508AB250DBB5698ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 05303474, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 053046B1

Memory Dump Source

Source File: 00000017.00000002.502625738.0000000005300000.00000040.00000001.sdmp, Offset: 05300000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8cc4b2488659bec5d07dbf83a805d574116a9b7a5aaed84cd65cc214cc1123de
Instruction ID: 4fa754328be561e167d494d9f989c73d3ab719c3a4e5676e3dfca1086442aca3
Opcode Fuzzy Hash: 8cc4b2488659bec5d07dbf83a805d574116a9b7a5aaed84cd65cc214cc1123de
Instruction Fuzzy Hash: 4C410071C0435CCBDF24CFA9C88479EBBB1BF49304F20805AD508AB250DBB5694ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 05302470, Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05302531

Memory Dump Source

Source File: 00000017.00000002.502625738.0000000005300000.00000040.00000001.sdmp, Offset: 05300000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 3e43da98e39deb051414850bc483cee988b5696f45bcd97f475a91e0bdd97ea8
Instruction ID: 657d19c0a83ed0cefbcf3a29d3aaaa5d4de390894c037eb6446dc06f87405289
Opcode Fuzzy Hash: 3e43da98e39deb051414850bc483cee988b5696f45bcd97f475a91e0bdd97ea8
Instruction Fuzzy Hash: 284117B89003058FCB14CF99C498AABFBF6FB88314F248459E519AB361D774A845CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0530B888, Relevance: 1.6, APIs: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?), ref: 0530B957

Memory Dump Source

Source File: 00000017.00000002.502625738.0000000005300000.00000040.00000001.sdmp, Offset: 05300000, based on PE: false

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 03223f0e027f10cbaa5843399e154f0af0bed18fa2ade03a252e989446b61680
Instruction ID: db0a2432eeee426a15b50a092ae0fdbadf6118fc6e47f228a48b6bf91c53002f
Opcode Fuzzy Hash: 03223f0e027f10cbaa5843399e154f0af0bed18fa2ade03a252e989446b61680
Instruction Fuzzy Hash: D531AF729043899FCB11CFA9D910ADEBFF4EF49310F14845AF594A7261C335D854DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0530B8E8, Relevance: 1.6, APIs: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?), ref: 0530B957

Memory Dump Source

Source File: 00000017.00000002.502625738.0000000005300000.00000040.00000001.sdmp, Offset: 05300000, based on PE: false

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 6ffc405b606aa07cc6b44b672393729d9e56e1e339f0a28c9323b9d89dca7c60
Instruction ID: 2e9a54f26b5a5d5ddcc73e4c1958e379710fe7ad82e9f45f061a08e680be2cec
Opcode Fuzzy Hash: 6ffc405b606aa07cc6b44b672393729d9e56e1e339f0a28c9323b9d89dca7c60
Instruction Fuzzy Hash: 8F1123B18042499FDB10CFAAC944BDEBBF8EB48320F14841AE954A7250C379A994DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0530E6D8, Relevance: 1.6, APIs: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,010953E8,00000000,?), ref: 0530E73D

Memory Dump Source

Source File: 00000017.00000002.502625738.0000000005300000.00000040.00000001.sdmp, Offset: 05300000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 9cdadd0814e53f849946290d8f418a4547a2434a7d28f12298641343c8c71061
Instruction ID: 9b8f41c0cd03c26938287e07a216449fe2a70f11e4bd2e1db514bd66df725449
Opcode Fuzzy Hash: 9cdadd0814e53f849946290d8f418a4547a2434a7d28f12298641343c8c71061
Instruction Fuzzy Hash: 331125B59003499FDB10CF99C885BEEBBF8FB48324F14841AE954A3250D378A985DFB5

Uniqueness

Uniqueness Score: -1.00%

Function 053032D8, Relevance: 1.6, APIs: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,010953E8,00000000,?), ref: 0530E73D

Memory Dump Source

Source File: 00000017.00000002.502625738.0000000005300000.00000040.00000001.sdmp, Offset: 05300000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 15461f2def5e229c3dfc6c44c1d0f65e94b74f051b5580384fcf64b1c2bc57a7
Instruction ID: 119aa12469e66d0e4f949a1c7a9582a45997053d09274936cb116add2acf68aa
Opcode Fuzzy Hash: 15461f2def5e229c3dfc6c44c1d0f65e94b74f051b5580384fcf64b1c2bc57a7
Instruction Fuzzy Hash: BF1128B59003499FDB10CF99C445BEEBBF8FB48314F10841AE954A3240D378A944DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0530D238, Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 0530D29D

Memory Dump Source

Source File: 00000017.00000002.502625738.0000000005300000.00000040.00000001.sdmp, Offset: 05300000, based on PE: false

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 27ba75015c1c3d79723c39b3ed8a33f875ef375c558d8ba913654a37584335a3
Instruction ID: 56e54f8d110e38f6a9a912a3d065830f4b9bc188a7e59b8e5a06b95ba0559c8c
Opcode Fuzzy Hash: 27ba75015c1c3d79723c39b3ed8a33f875ef375c558d8ba913654a37584335a3
Instruction Fuzzy Hash: D411F2B58003499FDB10CF99D985BDFBBF8FB48320F10881AE959A7640C3B4A584CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05301540, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,0000020A,?,00000000,?,?,?,?,0530226A,?,00000000,?), ref: 0530C435

Memory Dump Source

Source File: 00000017.00000002.502625738.0000000005300000.00000040.00000001.sdmp, Offset: 05300000, based on PE: false

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f6589947c4ed25a9683316182fadc252fa86d214a7281ec4b57aded82ba87b91
Instruction ID: a1911f4a52db9cfaa84242913e445ad040a0767c1ac010133f0f07cd7888b078
Opcode Fuzzy Hash: f6589947c4ed25a9683316182fadc252fa86d214a7281ec4b57aded82ba87b91
Instruction Fuzzy Hash: B61103B58047489FCB10CF99D984BEEFBF8FB48314F10851AE959A7640C3B4A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0530A548, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,?,00000000), ref: 0530BCBD

Memory Dump Source

Source File: 00000017.00000002.502625738.0000000005300000.00000040.00000001.sdmp, Offset: 05300000, based on PE: false

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 04a6def6e13fbaf63d6518291991cfa2d318a45016dabc4f204dd4323973781f
Instruction ID: 27da659084512af7f92abf209ea0f198e2cfc0b136199074968137f3680d723e
Opcode Fuzzy Hash: 04a6def6e13fbaf63d6518291991cfa2d318a45016dabc4f204dd4323973781f
Instruction Fuzzy Hash: F811E0B58047489FCB10CF99C984BDEFBF8FB48324F10841AE959A7640C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053050D4, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 0530D29D

Memory Dump Source

Source File: 00000017.00000002.502625738.0000000005300000.00000040.00000001.sdmp, Offset: 05300000, based on PE: false

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 057cd7e5a26535f40d8ea98c7459eb4ece9c6730fef0fcf62f4cb06db39b803c
Instruction ID: e3e8da438f2ef298fe41d5a425b0a90edb677013ccd5538b32d6a90e4a650434
Opcode Fuzzy Hash: 057cd7e5a26535f40d8ea98c7459eb4ece9c6730fef0fcf62f4cb06db39b803c
Instruction Fuzzy Hash: 8E11F2B58043489FDB10CF99C584BDEFBF8FB48324F10881AE959A7640C3B5A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0530C3D0, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,0000020A,?,00000000,?,?,?,?,0530226A,?,00000000,?), ref: 0530C435

Memory Dump Source

Source File: 00000017.00000002.502625738.0000000005300000.00000040.00000001.sdmp, Offset: 05300000, based on PE: false

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5d0408a15f3f9887ac936b488b745f9f1c7629bd96db923af85224a011812645
Instruction ID: dfdfd211ceb1a7554cf18e84e03540cb858281bb4f171b39cc25389dce1387e4
Opcode Fuzzy Hash: 5d0408a15f3f9887ac936b488b745f9f1c7629bd96db923af85224a011812645
Instruction Fuzzy Hash: 3F11E0B58002489FDB10CF99C889BDEBBF8FB48314F10841AE958A7640C375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0530BC59, Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,?,00000000), ref: 0530BCBD

Memory Dump Source

Source File: 00000017.00000002.502625738.0000000005300000.00000040.00000001.sdmp, Offset: 05300000, based on PE: false

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 02ba90e974a57cb4760a142681a9f8ebe14212e788e3c15fa509f58533e1fcf5
Instruction ID: ae54b9f13349439dc9f415f1ed8aed6e44740929a079c0329be46e03910830af
Opcode Fuzzy Hash: 02ba90e974a57cb4760a142681a9f8ebe14212e788e3c15fa509f58533e1fcf5
Instruction Fuzzy Hash: 4011C2B58007898FDB10CF99D585BDEFBF4EB48324F14881AE959A7640C374A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05590440, Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0559049D

Memory Dump Source

Source File: 00000017.00000002.503406678.0000000005590000.00000040.00000001.sdmp, Offset: 05590000, based on PE: false

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: cfd5000d34e8343574df835b726094fe2871887d1afa56c70b483d2a8bc98ce0
Instruction ID: 522cfcf2f0835dbae5cae87236d1eaf513967cbdc8ebc31a9b2e0fcb74bdfbf3
Opcode Fuzzy Hash: cfd5000d34e8343574df835b726094fe2871887d1afa56c70b483d2a8bc98ce0
Instruction Fuzzy Hash: 55110DB0C046488FCB10CF9AD448BCEFBF4FB48324F10882AE969A3250D378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05590438, Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0559049D

Memory Dump Source

Source File: 00000017.00000002.503406678.0000000005590000.00000040.00000001.sdmp, Offset: 05590000, based on PE: false

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: bb39b67c377d565d88e9866fa5932d85ff7cc11e9192c3ed64309d618708aec0
Instruction ID: d65de44e7ccf86f2dfb02fd450c1cee2f2fadf3651275465f57e0e47fa1af2a4
Opcode Fuzzy Hash: bb39b67c377d565d88e9866fa5932d85ff7cc11e9192c3ed64309d618708aec0
Instruction Fuzzy Hash: 151133B5C046488FCF10CFAAD5447CEFBF0BB48324F14891AD869A3250C338A144CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 20014464370.PDF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NanoCore

Yara Overview

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

AV Detection:

E-Banking Fraud:

System Summary:

Stealing of Sensitive Information:

Remote Access Functionality:

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre