Play interactive tour

Edit tour

Windows Analysis Report vHLZ6AHJFY.exe

Overview

General Information

Sample Name:	vHLZ6AHJFY.exe
Analysis ID:	458708
MD5:	e7f52d9d50e6d2776d301b5a7e03b662
SHA1:	3382b97a08277306637e074f08814b728bc225cc
SHA256:	fcf8936d333a76b64672ae8c445531efc277c0ad3222720e1c4b43573b681375
Tags:	exeNanoCoreRAT
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Yara detected AntiVM3

Yara detected Nanocore RAT

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Antivirus or Machine Learning detection for unpacked file

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

vHLZ6AHJFY.exe (PID: 4640 cmdline: 'C:\Users\user\Desktop\vHLZ6AHJFY.exe' MD5: E7F52D9D50E6D2776D301B5A7E03B662)

vHLZ6AHJFY.exe (PID: 4832 cmdline: C:\Users\user\Desktop\vHLZ6AHJFY.exe MD5: E7F52D9D50E6D2776D301B5A7E03B662)

dhcpmon.exe (PID: 2680 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' MD5: E7F52D9D50E6D2776D301B5A7E03B662)

dhcpmon.exe (PID: 5008 cmdline: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe MD5: E7F52D9D50E6D2776D301B5A7E03B662)

dhcpmon.exe (PID: 6008 cmdline: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe MD5: E7F52D9D50E6D2776D301B5A7E03B662)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "6a1c2465-7ac5-4f1d-acc5-ef04fcf4", "Group": "Default", "Domain1": "hhjhtggfr.duckdns.org", "Domain2": "dertrefg.duckdns.org", "Port": 8234, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "hhjhtggfr.duckdns.org"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.316057670.0000000002F21000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000D.00000002.316057670.0000000002F21000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6943f:$a: NanoCore 0x69498:$a: NanoCore 0x694d5:$a: NanoCore 0x6954e:$a: NanoCore 0x694a1:$b: ClientPlugin 0x694de:$b: ClientPlugin 0x69ddc:$b: ClientPlugin 0x69de9:$b: ClientPlugin 0x5f0a3:$e: KeepAlive 0x69929:$g: LogClientMessage 0x698a9:$i: get_Connected 0x59875:$j: #=q 0x598a5:$j: #=q 0x598e1:$j: #=q 0x59909:$j: #=q 0x59939:$j: #=q 0x59969:$j: #=q 0x59999:$j: #=q 0x599c9:$j: #=q 0x599e5:$j: #=q 0x59a15:$j: #=q
0000000D.00000002.315036949.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000D.00000002.315036949.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000D.00000002.315036949.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000D.00000002.316141333.0000000003F29000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000D.00000002.316141333.0000000003F29000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x42ee5:$a: NanoCore 0x42f3e:$a: NanoCore 0x42f7b:$a: NanoCore 0x42ff4:$a: NanoCore 0x5669f:$a: NanoCore 0x566b4:$a: NanoCore 0x566e9:$a: NanoCore 0x6f18b:$a: NanoCore 0x6f1a0:$a: NanoCore 0x6f1d5:$a: NanoCore 0x42f47:$b: ClientPlugin 0x42f84:$b: ClientPlugin 0x43882:$b: ClientPlugin 0x4388f:$b: ClientPlugin 0x5645b:$b: ClientPlugin 0x56476:$b: ClientPlugin 0x564a6:$b: ClientPlugin 0x566bd:$b: ClientPlugin 0x566f2:$b: ClientPlugin 0x6ef47:$b: ClientPlugin 0x6ef62:$b: ClientPlugin
00000000.00000002.243870600.00000000026DB000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000005.00000002.296482527.000000000256B000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000005.00000002.302655095.00000000033E9000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x47d1ad:$x1: NanoCore.ClientPluginHost 0x5255f5:$x1: NanoCore.ClientPluginHost 0x47d1ea:$x2: IClientNetworkHost 0x525632:$x2: IClientNetworkHost 0x480d1d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x529165:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000005.00000002.302655095.00000000033E9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000005.00000002.302655095.00000000033E9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x47cf15:$a: NanoCore 0x47cf25:$a: NanoCore 0x47d159:$a: NanoCore 0x47d16d:$a: NanoCore 0x47d1ad:$a: NanoCore 0x52535d:$a: NanoCore 0x52536d:$a: NanoCore 0x5255a1:$a: NanoCore 0x5255b5:$a: NanoCore 0x5255f5:$a: NanoCore 0x47cf74:$b: ClientPlugin 0x47d176:$b: ClientPlugin 0x47d1b6:$b: ClientPlugin 0x5253bc:$b: ClientPlugin 0x5255be:$b: ClientPlugin 0x5255fe:$b: ClientPlugin 0x47d09b:$c: ProjectData 0x5254e3:$c: ProjectData 0x780c2f:$c: ProjectData 0x82364f:$c: ProjectData 0x47daa2:$d: DESCrypto
00000000.00000002.246214384.0000000003559000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x47d1ad:$x1: NanoCore.ClientPluginHost 0x5255f5:$x1: NanoCore.ClientPluginHost 0x47d1ea:$x2: IClientNetworkHost 0x525632:$x2: IClientNetworkHost 0x480d1d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x529165:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.246214384.0000000003559000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.246214384.0000000003559000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x47cf15:$a: NanoCore 0x47cf25:$a: NanoCore 0x47d159:$a: NanoCore 0x47d16d:$a: NanoCore 0x47d1ad:$a: NanoCore 0x52535d:$a: NanoCore 0x52536d:$a: NanoCore 0x5255a1:$a: NanoCore 0x5255b5:$a: NanoCore 0x5255f5:$a: NanoCore 0x47cf74:$b: ClientPlugin 0x47d176:$b: ClientPlugin 0x47d1b6:$b: ClientPlugin 0x5253bc:$b: ClientPlugin 0x5255be:$b: ClientPlugin 0x5255fe:$b: ClientPlugin 0x47d09b:$c: ProjectData 0x5254e3:$c: ProjectData 0x780c2f:$c: ProjectData 0x82364f:$c: ProjectData 0x47daa2:$d: DESCrypto
Process Memory Space: vHLZ6AHJFY.exe PID: 4640	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x3fc6c0:$x1: NanoCore.ClientPluginHost 0x3fc6fd:$x2: IClientNetworkHost 0x3ffa9a:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x40a6d5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x418028:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: vHLZ6AHJFY.exe PID: 4640	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: vHLZ6AHJFY.exe PID: 4640	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: vHLZ6AHJFY.exe PID: 4640	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3fc513:$a: NanoCore 0x3fc523:$a: NanoCore 0x3fc57e:$a: NanoCore 0x3fc58d:$a: NanoCore 0x3fc66c:$a: NanoCore 0x3fc680:$a: NanoCore 0x3fc6c0:$a: NanoCore 0x406d3f:$a: NanoCore 0x406d51:$a: NanoCore 0x406d8d:$a: NanoCore 0x414692:$a: NanoCore 0x4146a4:$a: NanoCore 0x4146e0:$a: NanoCore 0x3fc537:$b: ClientPlugin 0x3fc5d7:$b: ClientPlugin 0x3fc689:$b: ClientPlugin 0x3fc6c9:$b: ClientPlugin 0x406d5a:$b: ClientPlugin 0x406d96:$b: ClientPlugin 0x4146ad:$b: ClientPlugin 0x4146e9:$b: ClientPlugin
Process Memory Space: dhcpmon.exe PID: 2680	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x3533c3:$x1: NanoCore.ClientPluginHost 0x353400:$x2: IClientNetworkHost 0x35679d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x3613d8:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x36ed2c:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 2680	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: dhcpmon.exe PID: 2680	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 2680	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x353216:$a: NanoCore 0x353226:$a: NanoCore 0x353281:$a: NanoCore 0x353290:$a: NanoCore 0x35336f:$a: NanoCore 0x353383:$a: NanoCore 0x3533c3:$a: NanoCore 0x35da42:$a: NanoCore 0x35da54:$a: NanoCore 0x35da90:$a: NanoCore 0x36b396:$a: NanoCore 0x36b3a8:$a: NanoCore 0x36b3e4:$a: NanoCore 0x35323a:$b: ClientPlugin 0x3532da:$b: ClientPlugin 0x35338c:$b: ClientPlugin 0x3533cc:$b: ClientPlugin 0x35da5d:$b: ClientPlugin 0x35da99:$b: ClientPlugin 0x36b3b1:$b: ClientPlugin 0x36b3ed:$b: ClientPlugin
Process Memory Space: dhcpmon.exe PID: 6008	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x167d7:$x1: NanoCore.ClientPluginHost 0x167f1:$x2: IClientNetworkHost 0x1cfeb:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x27a95:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 6008	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 6008	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xcea:$a: NanoCore 0xd46:$a: NanoCore 0xdc6:$a: NanoCore 0x1677f:$a: NanoCore 0x1679a:$a: NanoCore 0x167d7:$a: NanoCore 0x16850:$a: NanoCore 0x16bfb:$a: NanoCore 0x16c4e:$a: NanoCore 0x16c87:$a: NanoCore 0x16cfa:$a: NanoCore 0x177dc:$a: NanoCore 0x19921:$a: NanoCore 0x1997c:$a: NanoCore 0x1998b:$a: NanoCore 0x240ff:$a: NanoCore 0x24111:$a: NanoCore 0x2414d:$a: NanoCore 0x2f8b7:$a: NanoCore 0x2fb88:$a: NanoCore 0x50bab:$a: NanoCore
Click to see the 21 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.dhcpmon.exe.2f89660.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
13.2.dhcpmon.exe.2f89660.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
13.2.dhcpmon.exe.3f74565.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x23c70:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x23c9d:$x2: IClientNetworkHost
13.2.dhcpmon.exe.3f74565.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x23c70:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x24d4b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x23c8a:$s5: IClientLoggingHost
13.2.dhcpmon.exe.3f74565.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
13.2.dhcpmon.exe.3f6ff3c.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
13.2.dhcpmon.exe.3f6ff3c.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
13.2.dhcpmon.exe.3f6ff3c.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28299:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x282c6:$x2: IClientNetworkHost
13.2.dhcpmon.exe.3f6ff3c.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28299:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x29374:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x282b3:$s5: IClientLoggingHost
13.2.dhcpmon.exe.3f6ff3c.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
13.2.dhcpmon.exe.3f6ff3c.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
13.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
13.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
13.2.dhcpmon.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
13.2.dhcpmon.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
13.2.dhcpmon.exe.3f6b106.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d0cf:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d0fc:$x2: IClientNetworkHost
13.2.dhcpmon.exe.3f6b106.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d0cf:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e1aa:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d0e9:$s5: IClientLoggingHost
13.2.dhcpmon.exe.3f6b106.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
13.2.dhcpmon.exe.3f6b106.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d085:$a: NanoCore 0x2d09a:$a: NanoCore 0x2d0cf:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2ce41:$b: ClientPlugin 0x2ce5c:$b: ClientPlugin
5.2.dhcpmon.exe.38fe468.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.2.dhcpmon.exe.38fe468.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
5.2.dhcpmon.exe.38fe468.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.dhcpmon.exe.38fe468.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
0.2.vHLZ6AHJFY.exe.3a6e468.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.vHLZ6AHJFY.exe.3a6e468.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.vHLZ6AHJFY.exe.3a6e468.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.vHLZ6AHJFY.exe.3a6e468.5.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
5.2.dhcpmon.exe.38fe468.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.2.dhcpmon.exe.38fe468.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.dhcpmon.exe.38fe468.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x26b7c7:$c: ProjectData 0x30e1e7:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q
0.2.vHLZ6AHJFY.exe.3a6e468.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.vHLZ6AHJFY.exe.3a6e468.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.vHLZ6AHJFY.exe.3a6e468.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x26b7c7:$c: ProjectData 0x30e1e7:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q
Click to see the 28 entries

Sigma Overview

AV Detection:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\vHLZ6AHJFY.exe, ProcessId: 4832, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\vHLZ6AHJFY.exe, ProcessId: 4832, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Stealing of Sensitive Information:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\vHLZ6AHJFY.exe, ProcessId: 4832, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Remote Access Functionality:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\vHLZ6AHJFY.exe, ProcessId: 4832, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0000000D.00000002.316057670.0000000002F21000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "6a1c2465-7ac5-4f1d-acc5-ef04fcf4", "Group": "Default", "Domain1": "hhjhtggfr.duckdns.org", "Domain2": "dertrefg.duckdns.org", "Port": 8234, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "hhjhtggfr.duckdns.org"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Show sources

Source: vHLZ6AHJFY.exe	Virustotal: Detection: 31%			Perma Link
Source: vHLZ6AHJFY.exe	ReversingLabs: Detection: 21%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 13.2.dhcpmon.exe.3f74565.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.3f6ff3c.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.3f6ff3c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.3f6b106.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.38fe468.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.38fe468.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.316057670.0000000002F21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.315036949.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.316141333.0000000003F29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.302655095.00000000033E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.246214384.0000000003559000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vHLZ6AHJFY.exe PID: 4640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6008, type: MEMORYSTR

Machine Learning detection for dropped file

Show sources

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: vHLZ6AHJFY.exe

Joe Sandbox ML: detected

Source: 13.2.dhcpmon.exe.400000.0.unpack

Avira: Label: TR/Dropper.MSIL.Gen7

Source: vHLZ6AHJFY.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: vHLZ6AHJFY.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	5_2_06983680
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	5_2_06983671
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	5_2_06984858
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	5_2_06984849

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: hhjhtggfr.duckdns.org
Source: Malware configuration extractor	URLs: dertrefg.duckdns.org

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: hhjhtggfr.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.7:49715 -> 203.159.80.186:8234

Source: Joe Sandbox View

IP Address: 203.159.80.186 203.159.80.186

Source: Joe Sandbox View

ASN Name: LOVESERVERSGB LOVESERVERSGB

Source: unknown

DNS traffic detected: queries for: hhjhtggfr.duckdns.org

Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: vHLZ6AHJFY.exe, 00000000.00000002.243485690.0000000002551000.00000004.00000001.sdmp, dhcpmon.exe, 00000005.00000002.293431258.00000000023E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: vHLZ6AHJFY.exe, 00000000.00000002.243024787.00000000007E9000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: dhcpmon.exe, 0000000D.00000002.316057670.0000000002F21000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 13.2.dhcpmon.exe.3f74565.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.3f6ff3c.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.3f6ff3c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.3f6b106.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.38fe468.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.38fe468.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.316057670.0000000002F21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.315036949.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.316141333.0000000003F29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.302655095.00000000033E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.246214384.0000000003559000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vHLZ6AHJFY.exe PID: 4640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6008, type: MEMORYSTR

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 13.2.dhcpmon.exe.2f89660.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.dhcpmon.exe.3f74565.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.dhcpmon.exe.3f6ff3c.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.dhcpmon.exe.3f6ff3c.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 13.2.dhcpmon.exe.3f6b106.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.dhcpmon.exe.3f6b106.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.dhcpmon.exe.38fe468.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.dhcpmon.exe.38fe468.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.dhcpmon.exe.38fe468.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.dhcpmon.exe.38fe468.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000D.00000002.316057670.0000000002F21000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000D.00000002.315036949.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000D.00000002.315036949.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000D.00000002.316141333.0000000003F29000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000002.302655095.00000000033E9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000005.00000002.302655095.00000000033E9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.246214384.0000000003559000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.246214384.0000000003559000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: vHLZ6AHJFY.exe PID: 4640, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: vHLZ6AHJFY.exe PID: 4640, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 2680, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 2680, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 6008, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 6008, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Code function: 0_2_000F4C65	0_2_000F4C65
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Code function: 0_2_00A6C2B0	0_2_00A6C2B0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_00054C65	5_2_00054C65
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_00C1C2B0	5_2_00C1C2B0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_00C19990	5_2_00C19990
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_06983B80	5_2_06983B80
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_0698179E	5_2_0698179E
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_069815BF	5_2_069815BF
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_069815D0	5_2_069815D0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_06981210	5_2_06981210
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_06981200	5_2_06981200
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 11_2_00344C65	11_2_00344C65
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 13_2_00BC4C65	13_2_00BC4C65
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 13_2_0540E471	13_2_0540E471
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 13_2_0540E480	13_2_0540E480
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 13_2_0540BBD4	13_2_0540BBD4

Source: vHLZ6AHJFY.exe	Binary or memory string: OriginalFilename vs vHLZ6AHJFY.exe
Source: vHLZ6AHJFY.exe, 00000000.00000000.224394981.00000000000F2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameGenericSecurityDescript.exe6 vs vHLZ6AHJFY.exe
Source: vHLZ6AHJFY.exe, 00000000.00000002.252836540.0000000006AC0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs vHLZ6AHJFY.exe
Source: vHLZ6AHJFY.exe, 00000000.00000002.243485690.0000000002551000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameConfigNodeType.dll> vs vHLZ6AHJFY.exe
Source: vHLZ6AHJFY.exe, 00000000.00000002.253509646.0000000006D90000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameStoreElement.dllB vs vHLZ6AHJFY.exe
Source: vHLZ6AHJFY.exe, 00000000.00000002.243024787.00000000007E9000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs vHLZ6AHJFY.exe
Source: vHLZ6AHJFY.exe, 00000002.00000000.239859981.0000000000492000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameGenericSecurityDescript.exe6 vs vHLZ6AHJFY.exe
Source: vHLZ6AHJFY.exe	Binary or memory string: OriginalFilenameGenericSecurityDescript.exe6 vs vHLZ6AHJFY.exe

Source: vHLZ6AHJFY.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 13.2.dhcpmon.exe.2f89660.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.2.dhcpmon.exe.2f89660.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.dhcpmon.exe.3f74565.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.2.dhcpmon.exe.3f74565.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.dhcpmon.exe.3f6ff3c.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.2.dhcpmon.exe.3f6ff3c.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.dhcpmon.exe.3f6ff3c.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.2.dhcpmon.exe.3f6ff3c.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 13.2.dhcpmon.exe.3f6b106.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.2.dhcpmon.exe.3f6b106.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.dhcpmon.exe.3f6b106.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.2.dhcpmon.exe.38fe468.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.dhcpmon.exe.38fe468.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.dhcpmon.exe.38fe468.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.2.dhcpmon.exe.38fe468.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.dhcpmon.exe.38fe468.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000D.00000002.316057670.0000000002F21000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000D.00000002.315036949.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000D.00000002.315036949.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000D.00000002.316141333.0000000003F29000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000005.00000002.302655095.00000000033E9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000005.00000002.302655095.00000000033E9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.246214384.0000000003559000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.246214384.0000000003559000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: vHLZ6AHJFY.exe PID: 4640, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: vHLZ6AHJFY.exe PID: 4640, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 2680, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 2680, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 6008, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 6008, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: vHLZ6AHJFY.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dhcpmon.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 13.2.dhcpmon.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 13.2.dhcpmon.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 13.2.dhcpmon.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/8@19/2

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vHLZ6AHJFY.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\{6a1c2465-7ac5-4f1d-acc5-ef04fcf454c9}

Source: vHLZ6AHJFY.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: vHLZ6AHJFY.exe	Virustotal: Detection: 31%
Source: vHLZ6AHJFY.exe	ReversingLabs: Detection: 21%

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe

File read: C:\Users\user\Desktop\vHLZ6AHJFY.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\vHLZ6AHJFY.exe 'C:\Users\user\Desktop\vHLZ6AHJFY.exe'
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process created: C:\Users\user\Desktop\vHLZ6AHJFY.exe C:\Users\user\Desktop\vHLZ6AHJFY.exe
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process created: C:\Users\user\Desktop\vHLZ6AHJFY.exe C:\Users\user\Desktop\vHLZ6AHJFY.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to behavior

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: vHLZ6AHJFY.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: vHLZ6AHJFY.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: vHLZ6AHJFY.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 13.2.dhcpmon.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.2.dhcpmon.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: vHLZ6AHJFY.exe

Static PE information: 0xFAEB95B0 [Sun May 27 21:08:00 2103 UTC]

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_06980FD6 push ebx; iretd	5_2_06980FDD
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_06981002 push es; iretd	5_2_0698107C
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 5_2_0698107D push es; ret	5_2_069810BC

Source: initial sample	Static PE information: section name: .text entropy: 7.44654724316
Source: initial sample	Static PE information: section name: .text entropy: 7.44654724316

Source: 13.2.dhcpmon.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 13.2.dhcpmon.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe

File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe

File opened: C:\Users\user\Desktop\vHLZ6AHJFY.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.243870600.00000000026DB000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.296482527.000000000256B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vHLZ6AHJFY.exe PID: 4640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2680, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: vHLZ6AHJFY.exe, 00000000.00000002.243870600.00000000026DB000.00000004.00000001.sdmp, dhcpmon.exe, 00000005.00000002.296482527.000000000256B000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: vHLZ6AHJFY.exe, 00000000.00000002.243870600.00000000026DB000.00000004.00000001.sdmp, dhcpmon.exe, 00000005.00000002.296482527.000000000256B000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Window / User API: threadDelayed 3777	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Window / User API: threadDelayed 4740	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Window / User API: foregroundWindowGot 597	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Window / User API: foregroundWindowGot 710	Jump to behavior

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe TID: 4932	Thread sleep time: -42714s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe TID: 2912	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe TID: 4736	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 3588	Thread sleep time: -44543s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5864	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 496	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Thread delayed: delay time: 42714	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 44543	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: dhcpmon.exe, 00000005.00000002.296482527.000000000256B000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: dhcpmon.exe, 00000005.00000002.296482527.000000000256B000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 00000005.00000002.296482527.000000000256B000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: vHLZ6AHJFY.exe	Binary or memory string: %QeMu
Source: dhcpmon.exe, 00000005.00000002.296482527.000000000256B000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: dhcpmon.exe, 00000005.00000002.296482527.000000000256B000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 00000005.00000002.296482527.000000000256B000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: dhcpmon.exe, 00000005.00000002.296482527.000000000256B000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: dhcpmon.exe, 00000005.00000002.296482527.000000000256B000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Process created: C:\Users\user\Desktop\vHLZ6AHJFY.exe C:\Users\user\Desktop\vHLZ6AHJFY.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to behavior

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Users\user\Desktop\vHLZ6AHJFY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Users\user\Desktop\vHLZ6AHJFY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\vHLZ6AHJFY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 13.2.dhcpmon.exe.3f74565.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.3f6ff3c.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.3f6ff3c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.3f6b106.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.38fe468.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.38fe468.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.316057670.0000000002F21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.315036949.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.316141333.0000000003F29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.302655095.00000000033E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.246214384.0000000003559000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vHLZ6AHJFY.exe PID: 4640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6008, type: MEMORYSTR

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: vHLZ6AHJFY.exe, 00000000.00000002.246214384.0000000003559000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000005.00000002.302655095.00000000033E9000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000D.00000002.316057670.0000000002F21000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000D.00000002.316057670.0000000002F21000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 13.2.dhcpmon.exe.3f74565.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.3f6ff3c.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.3f6ff3c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.dhcpmon.exe.3f6b106.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.38fe468.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.dhcpmon.exe.38fe468.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vHLZ6AHJFY.exe.3a6e468.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.316057670.0000000002F21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.315036949.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.316141333.0000000003F29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.302655095.00000000033E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.246214384.0000000003559000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vHLZ6AHJFY.exe PID: 4640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6008, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	Path Interception	Process Injection11	Masquerading2	Input Capture21	Query Registry1	Remote Services	Input Capture21	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Security Software Discovery211	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion21	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection11	NTDS	Virtualization/Sandbox Evasion21	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol21	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	System Information Discovery12	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information3	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing13	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Timestomp1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vHLZ6AHJFY.exe	31%	Virustotal		Browse
vHLZ6AHJFY.exe	22%	ReversingLabs	Win32.Trojan.Pwsx
vHLZ6AHJFY.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	22%	ReversingLabs	Win32.Trojan.Pwsx

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
13.2.dhcpmon.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
hhjhtggfr.duckdns.org	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
dertrefg.duckdns.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
hhjhtggfr.duckdns.org	203.159.80.186	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
hhjhtggfr.duckdns.org	true	Avira URL Cloud: safe	unknown
dertrefg.duckdns.org	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false		high
http://www.tiro.com	dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false		high
http://www.fonts.com	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vHLZ6AHJFY.exe, 00000000.00000002.243485690.0000000002551000.00000004.00000001.sdmp, dhcpmon.exe, 00000005.00000002.293431258.00000000023E1000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	vHLZ6AHJFY.exe, 00000000.00000002.251061687.00000000055C0000.00000002.00000001.sdmp, dhcpmon.exe, 00000005.00000002.308306579.0000000005530000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
203.159.80.186	hhjhtggfr.duckdns.org	Netherlands		47987	LOVESERVERSGB	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	458708
Start date:	03.08.2021
Start time:	17:05:42
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	vHLZ6AHJFY.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/8@19/2
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 51 Number of non-executed functions: 4
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 13.88.21.125, 104.42.151.234, 52.147.198.201, 23.211.4.86, 20.50.102.62, 20.54.110.249, 40.112.88.60, 80.67.82.235, 80.67.82.211 Excluded domains from analysis (whitelisted): fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, blobcollector.events.data.trafficmanager.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, skypedataprdcolwus15.cloudapp.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:06:36	API Interceptor	1012x Sleep call for process: vHLZ6AHJFY.exe modified
17:06:44	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
17:06:57	API Interceptor	1x Sleep call for process: dhcpmon.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
203.159.80.186	NEW PO1100372954 -.doc	Get hash	malicious	Browse	newhosteeeee.ydns.eu/putty.exe
	2711164142.doc	Get hash	malicious	Browse	newhosteeeee.ydns.eu/microF.exe
	N40-MR .doc	Get hash	malicious	Browse	newhosteeeee.ydns.eu/microC.exe
	N40-MR 311.doc	Get hash	malicious	Browse	newhosteeeee.ydns.eu/microA.exe
	PO2100382954 -.doc	Get hash	malicious	Browse	newhosteeeee.ydns.eu/microD.exe
	2fja1Oszs9.exe	Get hash	malicious	Browse	hutyrtit.ydns.eu/microC.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
hhjhtggfr.duckdns.org	NEW PO1100372954 -.doc	Get hash	malicious	Browse	203.159.80.186
	N40-MR 311.doc	Get hash	malicious	Browse	203.159.80.186
	Xjf4yH9N2t.exe	Get hash	malicious	Browse	203.159.80.186
	wm4J5m8pIK.exe	Get hash	malicious	Browse	203.159.80.186
	WrNhr6yUD8.exe	Get hash	malicious	Browse	37.0.8.214
	YjnGfifJ4X.exe	Get hash	malicious	Browse	203.159.80.101
	E8NURjuahU.exe	Get hash	malicious	Browse	203.159.80.101
	MkASxmQIe3.exe	Get hash	malicious	Browse	203.159.80.101
	6rkqQM8Ldz.exe	Get hash	malicious	Browse	203.159.80.101
	bHSfr2q0yu.exe	Get hash	malicious	Browse	203.159.80.101
	lqtN3Z5Uzp.exe	Get hash	malicious	Browse	203.159.80.101
	Invoice 406496.doc	Get hash	malicious	Browse	203.159.80.101
	1OLlrVAlAE.exe	Get hash	malicious	Browse	203.159.80.101
	microC.exe	Get hash	malicious	Browse	203.159.80.101

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
LOVESERVERSGB	Shipping Details.exe	Get hash	malicious	Browse	203.159.80.118
	NEW PO1100372954 -.doc	Get hash	malicious	Browse	203.159.80.165
	2711164142.doc	Get hash	malicious	Browse	203.159.80.165
	N40-MR .doc	Get hash	malicious	Browse	203.159.80.186
	N40-MR 311.doc	Get hash	malicious	Browse	203.159.80.165
	PO2100382954 -.doc	Get hash	malicious	Browse	203.159.80.186
	Xjf4yH9N2t.exe	Get hash	malicious	Browse	203.159.80.165
	wm4J5m8pIK.exe	Get hash	malicious	Browse	203.159.80.186
	2fja1Oszs9.exe	Get hash	malicious	Browse	203.159.80.186
	SKM-582649274924.exe	Get hash	malicious	Browse	203.159.80.93
	Shipping Details_PDF.exe	Get hash	malicious	Browse	203.159.80.118
	eInvoicing.jar	Get hash	malicious	Browse	203.159.80.23
	DyxL4y2hv3.exe	Get hash	malicious	Browse	203.159.80.165
	ktWmI8zMGs.exe	Get hash	malicious	Browse	203.159.80.182
	fBR05jzjti.exe	Get hash	malicious	Browse	203.159.80.165
	Original Shipping .doc	Get hash	malicious	Browse	203.159.80.165
	hfJdO3BjO0.exe	Get hash	malicious	Browse	203.159.80.107
	No.IV21002542.doc	Get hash	malicious	Browse	203.159.80.107
	payment details.doc	Get hash	malicious	Browse	203.159.80.107
	DblVVdaNgC.exe	Get hash	malicious	Browse	203.159.80.107

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Download File
Process:	C:\Users\user\Desktop\vHLZ6AHJFY.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	835072
Entropy (8bit):	7.439063931141525
Encrypted:	false
SSDEEP:	12288:SZdWFS44N+vWrz4C89yIkjPeO6gSxW61AannR6VJj134bGlvpmjz2iN:SbWFSn+vW4F5yPeJgqWkAYngHj1dpY1
MD5:	E7F52D9D50E6D2776D301B5A7E03B662
SHA1:	3382B97A08277306637E074F08814B728BC225CC
SHA-256:	FCF8936D333A76B64672AE8C445531EFC277C0AD3222720E1C4B43573B681375
SHA-512:	924B09B696ED70EF112DE29B61F90AB01E818F901EBA58F21685E95EBE1B4F0810DFBB2D28CDF41B1E1C58CB179EB6DF0A19969180E67ED335EC084E65423FD0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 22%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................P.................. ........@.. ....................... ............@.....................................O...................................x................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H...........l........... ...X............................................0............(....(..........(.....o..........................( ......(!......("......(#......($....N..(....o^...(%....&..(&.....s'........s(........s)........s........s+............0...........~....o,....+...0...........~....o-....+...0...........~....o.....+...0...........~....o/....+...0...........~....o0....+...0..<........~.....(1.....,!r...p.....(2...o3...s4............~.....+...0......

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\vHLZ6AHJFY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vHLZ6AHJFY.exe.log Download File
Process:	C:\Users\user\Desktop\vHLZ6AHJFY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat Download File
Process:	C:\Users\user\Desktop\vHLZ6AHJFY.exe
File Type:	data
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	7.024371743172393
Encrypted:	false
SSDEEP:	48:Ik/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrw8:flC0IlC0IlC0IlC0IlC0IlC0IlC0IlCe
MD5:	0D6805D12813A857D50D42D6EE2CCAB0
SHA1:	78D83F009D842F21FE2AB0EAFFD00E5AAD1776F4
SHA-256:	182E0F8AA959549D61C66D049645BA8445D86AEAD2B8C3552A9836FA1E5BD484
SHA-512:	5B29496F3AB3CCB915CF37042F4956BB00E577B5F15457A5A739BE1BD50C481FB7E3297EED575DCA7A7BD30ECBC140DD3666CD7DEDD25DFB7AEB41A1B5BEDA4A
Malicious:	false
Reputation:	unknown
Preview:	Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Users\user\Desktop\vHLZ6AHJFY.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:N4n:W
MD5:	C2BD38A6DB63769773CAFA759E408A99
SHA1:	C865D09925B221950EEA216FEAEF74C6F9BB4EE9
SHA-256:	D62FD7B51C8B8FBD978A82CE646961CA86E5DEE11C3DA8CCF5DF4877A14E56C6
SHA-512:	627141212397F00ED3D8E24BDAA2E3B1A3C60ADC3779BA24DF96773F87B04D23E98B1393E684C2B90A529C6012E5D87F818408BDDCAB2E07D0D3D24EA02EBF7A
Malicious:	true
Reputation:	unknown
Preview:	"%:..V.H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bin Download File
Process:	C:\Users\user\Desktop\vHLZ6AHJFY.exe
File Type:	data
Category:	modified
Size (bytes):	40
Entropy (8bit):	5.153055907333276
Encrypted:	false
SSDEEP:	3:9bzY6oRDT6P2bfVn1:RzWDT621
MD5:	4E5E92E2369688041CC82EF9650EDED2
SHA1:	15E44F2F3194EE232B44E9684163B6F66472C862
SHA-256:	F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
SHA-512:	1B368018907A3BC30421FDA2C935B39DC9073B9B1248881E70AD48EDB6CAA256070C1A90B97B0F64BBE61E316DBB8D5B2EC8DBABCD0B0B2999AB50B933671ECB
Malicious:	false
Reputation:	unknown
Preview:	9iH...}Z.4..f.~a........~.~.......3.U.

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\storage.dat Download File
Process:	C:\Users\user\Desktop\vHLZ6AHJFY.exe
File Type:	data
Category:	dropped
Size (bytes):	327432
Entropy (8bit):	7.99938831605763
Encrypted:	true
SSDEEP:	6144:oX44S90aTiB66x3Pl6nGV4bfD6wXPIZ9iBj0UeprGm2d7Tm:LkjYGsfGUc9iB4UeprKdnm
MD5:	7E8F4A764B981D5B82D1CC49D341E9C6
SHA1:	D9F0685A028FB219E1A6286AEFB7D6FCFC778B85
SHA-256:	0BD3AAC12623520C4E2031C8B96B4A154702F36F97F643158E91E987D317B480
SHA-512:	880E46504FCFB4B15B86B9D8087BA88E6C4950E433616EBB637799F42B081ABF6F07508943ECB1F786B2A89E751F5AE62D750BDCFFDDF535D600CF66EC44E926
Malicious:	false
Reputation:	unknown
Preview:	pT..!..W..G.J..a.).@.i..wpK.so@...5.=.^..Q.oy.=e@9.B...F..09u"3.. 0t..RDn_4d.....E...i......~...\|..fX_...Xf.p^......>a..$...e.6:7d.(a.A...=.).....{B.[...y%...i.Q.<..xt.X..H.. ..HF7g...I.3.{.n....L.y;i..s-....(5i...........J.5b7}..fK..HV..,...0.... ....n.w6PMl.......v."".v.......#..X.a....../...cC...i..l{>5n.._+.e.d'...}...[..../...D.t..GVp.zz......(...o......b...+`J.{....hS1G.^I..v&.jm.#u..1..Mg!.E..U.T.....6.2>...6.l.K.w"o..E..."K%{....z.7....<...,....]t.:.....[.Z.u...3X8.QI..j_.&..N..q.e.2...6.R.~..9.Bq..A.v.6.G..#y.....O....Z)G...w..E..k(....+..O..........Vg.2xC......O...jc.....z..~.P...q../.-.'.h.._.cj.=..B.x.Q9.pu.\|i4...i...;O...n.?.,. ....v?.5}.OY@.dG\|<.._[.69@.2..m..I..oP=...xrK.?............b..5....i&...l.c\b}..Q..O+.V.mJ.....pz....>F.......H...6$...d...\|m...N..1.R..B.i..........$....$........CY}..$....r.....H...8...li.....7 P......?h....R.iF..6...q(.@LI.s..+K.....?m..H....*. l..&<}....`\|.B....3.....I..o...u1..8i=.z.W..7

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.439063931141525
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	vHLZ6AHJFY.exe
File size:	835072
MD5:	e7f52d9d50e6d2776d301b5a7e03b662
SHA1:	3382b97a08277306637e074f08814b728bc225cc
SHA256:	fcf8936d333a76b64672ae8c445531efc277c0ad3222720e1c4b43573b681375
SHA512:	924b09b696ed70ef112de29b61f90ab01e818f901eba58f21685e95ebe1b4f0810dfbb2d28cdf41b1e1c58cb179eb6df0a19969180e67ed335ec084e65423fd0
SSDEEP:	12288:SZdWFS44N+vWrz4C89yIkjPeO6gSxW61AannR6VJj134bGlvpmjz2iN:SbWFSn+vW4F5yPeJgqWkAYngHj1dpY1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................P.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4cd3e6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xFAEB95B0 [Sun May 27 21:08:00 2103 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcd394	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xce000	0x5ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xcd378	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xcb3ec	0xcb400	False	0.789118955643	data	7.44654724316	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xce000	0x5ec	0x600	False	0.430989583333	data	4.2010150696	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd0000	0xc	0x200	False	0.044921875	data	0.0980041756627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xce090	0x35c	data
RT_MANIFEST	0xce3fc	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2020
Assembly Version	1.0.0.0
InternalName	GenericSecurityDescript.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	Modul VB 3
ProductVersion	1.0.0.0
FileDescription	Modul VB 3
OriginalFilename	GenericSecurityDescript.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 3, 2021 17:06:41.419050932 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.447469950 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.447678089 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.492496967 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.549215078 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.559194088 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.588100910 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.627763987 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.704857111 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.705209970 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.749450922 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.749484062 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.749509096 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.749532938 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.749650002 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.778403997 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.778470039 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.778492928 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.778517962 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.778541088 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.778562069 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.778578997 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.778590918 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.778614998 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.778701067 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.778711081 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.807434082 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.807476044 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.807497978 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.807518005 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.807537079 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.807554960 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.807564974 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.807574034 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.807595015 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.807598114 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.807615042 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.807637930 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.807640076 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.807660103 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.807678938 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.807687044 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.807760000 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.807764053 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.808185101 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.808218002 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.808238029 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.808255911 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.808341026 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.836631060 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.836668015 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.836693048 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.836714029 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.836739063 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.836761951 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.836771011 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.836785078 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.836807966 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.836831093 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.836852074 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.836857080 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.836877108 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.836899042 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.836924076 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.836925030 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.836949110 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.836971045 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.836977959 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.836993933 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837017059 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837018013 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.837039948 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837061882 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837084055 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837088108 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.837110043 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837133884 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837155104 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837157965 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.837177992 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837199926 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837223053 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837224007 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.837245941 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837269068 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837269068 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.837295055 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837316990 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837338924 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837341070 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.837362051 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.837387085 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.837642908 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.866172075 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866205931 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866225004 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866242886 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866260052 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866277933 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866293907 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866312027 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866328955 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866345882 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866362095 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866378069 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866395950 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866411924 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866429090 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866444111 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866460085 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866475105 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866491079 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866508961 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866525888 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866544962 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866563082 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866578102 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866595030 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866611958 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866630077 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866646051 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866663933 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866681099 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866698980 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866723061 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866749048 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866766930 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866791964 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866815090 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866831064 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.866836071 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866858006 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866880894 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866882086 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.866904020 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866928101 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866930008 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.866951942 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.866954088 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.866980076 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.867002964 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.867012024 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.867026091 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.867048025 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.867069006 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.867072105 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.867093086 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.867125034 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.867212057 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898163080 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898207903 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898231983 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898255110 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898272991 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898277998 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898302078 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898324966 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898327112 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898349047 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898371935 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898372889 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898396015 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898399115 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898425102 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898444891 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898448944 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898468971 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898492098 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898504972 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898514032 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898538113 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898560047 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898564100 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898586988 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898612022 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898617029 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898634911 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898659945 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898660898 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898684025 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898684978 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898708105 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898730993 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898731947 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898752928 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898777008 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898777962 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898803949 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898825884 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898825884 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898849964 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898871899 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898878098 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898894072 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898916006 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898936987 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898957968 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.898962021 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.898987055 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.899008036 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.899015903 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.899032116 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.899054050 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.899059057 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.899077892 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.899100065 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.899125099 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.899137974 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.899161100 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.899163008 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.899185896 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.899209023 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.899230003 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.899234056 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.899252892 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.899255037 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.899276018 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.899297953 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.899298906 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.899672985 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.928554058 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928596020 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928620100 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928642035 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928664923 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928689003 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928710938 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928719044 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.928735018 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928756952 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.928760052 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928787947 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928809881 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.928812981 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928836107 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928836107 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.928860903 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928889990 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928910971 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.928913116 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928936958 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.928936958 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928962946 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.928985119 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929004908 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929008007 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929030895 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929053068 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929058075 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929080009 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929085016 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929110050 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929132938 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929153919 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929156065 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929178953 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929182053 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929207087 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929229975 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929248095 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929256916 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929282904 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929303885 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929306984 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929326057 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929328918 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929352999 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929375887 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929397106 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929398060 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929423094 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929447889 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929455996 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929478884 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929482937 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929506063 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929526091 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929533005 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929555893 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929579020 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929579020 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929605007 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929609060 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929629087 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929652929 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929673910 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929676056 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929701090 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929722071 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.929728031 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.929841995 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.958849907 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.958884954 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.958908081 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.958926916 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.958949089 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.958976984 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959000111 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959000111 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959023952 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959047079 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959048986 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959069967 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959072113 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959091902 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959122896 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959130049 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959163904 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959187031 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959208965 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959230900 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959235907 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959254980 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959279060 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959301949 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959301949 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959327936 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959353924 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959358931 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959378958 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959383011 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959403038 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959424973 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959431887 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959458113 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959480047 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959501982 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959511042 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959526062 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959530115 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959552050 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959575891 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959584951 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959598064 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959620953 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959641933 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959664106 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959666967 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959691048 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959713936 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959714890 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959738016 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959739923 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959759951 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959781885 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959783077 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959806919 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959827900 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959829092 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959850073 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959851980 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959877014 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959898949 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959919930 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.959942102 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.959943056 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960014105 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.960017920 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.960021019 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960045099 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960066080 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960087061 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960108042 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.960108995 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960130930 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960153103 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960172892 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.960172892 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960201025 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960223913 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.960223913 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960247993 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960249901 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.960270882 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960293055 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.960293055 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960316896 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960336924 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.960338116 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960361004 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960381031 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.960386992 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960410118 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:41.960410118 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:41.960530996 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:42.721518040 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:42.806343079 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:43.106822968 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:43.199670076 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:43.373306990 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:43.423626900 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:43.452375889 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:43.496203899 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:43.635279894 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:43.726114035 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:43.726186037 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:43.730990887 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:43.759551048 CEST	8234	49715	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:43.759659052 CEST	49715	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:48.526257992 CEST	49721	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:48.571677923 CEST	8234	49721	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:48.571770906 CEST	49721	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:48.576494932 CEST	49721	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:48.627063036 CEST	8234	49721	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:48.627424955 CEST	49721	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:48.662981033 CEST	8234	49721	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:48.664768934 CEST	49721	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:48.753715038 CEST	8234	49721	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:48.801146984 CEST	49721	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:48.892659903 CEST	8234	49721	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:49.010313988 CEST	8234	49721	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:49.055007935 CEST	49721	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:49.085387945 CEST	8234	49721	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:49.126516104 CEST	49721	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:49.179481030 CEST	8234	49721	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:49.223654985 CEST	49721	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:49.253230095 CEST	8234	49721	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:49.258130074 CEST	49721	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:49.298063993 CEST	8234	49721	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:49.298156977 CEST	49721	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:49.328324080 CEST	8234	49721	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:49.337188005 CEST	49721	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:49.423973083 CEST	8234	49721	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:49.424124002 CEST	49721	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:49.504483938 CEST	8234	49721	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:49.838992119 CEST	49721	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:49.923592091 CEST	8234	49721	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:50.846786022 CEST	49721	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:54.925400019 CEST	49726	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:54.954674006 CEST	8234	49726	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:54.955992937 CEST	49726	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:54.956532955 CEST	49726	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:55.006112099 CEST	8234	49726	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:55.006453991 CEST	49726	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:55.040153980 CEST	8234	49726	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:55.041879892 CEST	49726	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:55.126796007 CEST	8234	49726	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:55.385163069 CEST	8234	49726	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:55.386470079 CEST	49726	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:55.414794922 CEST	8234	49726	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:55.455271006 CEST	49726	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:55.680583954 CEST	8234	49726	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:55.722079992 CEST	49726	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:55.728912115 CEST	49726	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:55.750449896 CEST	8234	49726	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:55.802752972 CEST	49726	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:55.816200972 CEST	8234	49726	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:55.818831921 CEST	49726	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:55.852577925 CEST	8234	49726	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:55.852720022 CEST	49726	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:55.883362055 CEST	8234	49726	203.159.80.186	192.168.2.7
Aug 3, 2021 17:06:55.924122095 CEST	49726	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:06:56.861908913 CEST	49726	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:01.014367104 CEST	49727	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:01.049118042 CEST	8234	49727	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:01.050467968 CEST	49727	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:01.050657034 CEST	49727	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:01.148693085 CEST	8234	49727	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:01.208693027 CEST	8234	49727	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:01.210216045 CEST	49727	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:01.241077900 CEST	8234	49727	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:01.245893002 CEST	49727	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:01.329593897 CEST	8234	49727	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:01.568006039 CEST	8234	49727	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:01.569493055 CEST	49727	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:01.599030018 CEST	8234	49727	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:01.600552082 CEST	49727	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:01.630060911 CEST	8234	49727	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:01.630227089 CEST	49727	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:01.659980059 CEST	8234	49727	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:01.660523891 CEST	49727	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:01.735805988 CEST	8234	49727	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:01.940772057 CEST	49727	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:02.033094883 CEST	8234	49727	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:02.956407070 CEST	49727	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:07.081504107 CEST	49728	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:07.110884905 CEST	8234	49728	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:07.111008883 CEST	49728	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:07.111814976 CEST	49728	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:07.146775007 CEST	8234	49728	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:07.221803904 CEST	49728	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:07.251710892 CEST	8234	49728	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:07.259974957 CEST	49728	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:07.290853977 CEST	8234	49728	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:07.313666105 CEST	49728	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:07.405239105 CEST	8234	49728	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:07.622720957 CEST	8234	49728	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:07.625304937 CEST	49728	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:07.654581070 CEST	8234	49728	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:07.721837997 CEST	49728	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:07.750494003 CEST	8234	49728	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:07.750885963 CEST	49728	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:07.784698009 CEST	8234	49728	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:07.784785032 CEST	49728	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:07.819202900 CEST	8234	49728	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:07.821115971 CEST	49728	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:07.899569988 CEST	8234	49728	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:08.019423008 CEST	49728	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:12.737549067 CEST	49729	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:12.767461061 CEST	8234	49729	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:12.767551899 CEST	49729	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:12.768237114 CEST	49729	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:12.815283060 CEST	8234	49729	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:12.815538883 CEST	49729	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:12.844954967 CEST	8234	49729	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:12.846575022 CEST	49729	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:12.928488016 CEST	8234	49729	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:13.147233009 CEST	8234	49729	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:13.148230076 CEST	49729	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:13.186942101 CEST	8234	49729	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:13.237935066 CEST	49729	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:13.266920090 CEST	8234	49729	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:13.267193079 CEST	49729	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:13.297333002 CEST	8234	49729	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:13.297403097 CEST	49729	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:13.327326059 CEST	8234	49729	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:13.327413082 CEST	49729	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:13.412143946 CEST	8234	49729	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:13.723911047 CEST	49729	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:13.815445900 CEST	8234	49729	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:14.810436010 CEST	49729	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:18.884246111 CEST	49731	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:18.914035082 CEST	8234	49731	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:18.914176941 CEST	49731	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:18.914622068 CEST	49731	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:19.002111912 CEST	8234	49731	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:19.113146067 CEST	8234	49731	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:19.113614082 CEST	49731	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:19.146533012 CEST	8234	49731	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:19.148149014 CEST	49731	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:19.236541986 CEST	8234	49731	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:19.568384886 CEST	8234	49731	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:19.569622040 CEST	49731	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:19.602605104 CEST	8234	49731	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:19.722856998 CEST	49731	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:19.738945007 CEST	49731	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:19.751666069 CEST	8234	49731	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:19.817034006 CEST	8234	49731	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:19.817128897 CEST	49731	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:19.846126080 CEST	8234	49731	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:19.846224070 CEST	49731	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:19.874526978 CEST	8234	49731	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:19.926016092 CEST	49731	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:20.770421028 CEST	49731	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:24.886889935 CEST	49740	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:24.915456057 CEST	8234	49740	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:24.915549994 CEST	49740	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:24.958379030 CEST	49740	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:25.026984930 CEST	8234	49740	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:25.027328968 CEST	49740	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:25.057230949 CEST	8234	49740	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:25.058815956 CEST	49740	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:25.142599106 CEST	8234	49740	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:25.434545040 CEST	8234	49740	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:25.440268993 CEST	49740	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:25.469793081 CEST	8234	49740	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:25.567140102 CEST	49740	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:25.597848892 CEST	8234	49740	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:25.770281076 CEST	49740	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:25.799956083 CEST	8234	49740	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:25.800359964 CEST	49740	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:25.829735041 CEST	8234	49740	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:25.830079079 CEST	49740	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:25.866868973 CEST	8234	49740	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:25.867017031 CEST	49740	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:25.953707933 CEST	8234	49740	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:25.958245993 CEST	49740	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:26.047585964 CEST	8234	49740	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:26.911622047 CEST	49740	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:30.998208046 CEST	49743	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:31.027093887 CEST	8234	49743	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:31.027245998 CEST	49743	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:31.027714968 CEST	49743	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:31.073856115 CEST	8234	49743	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:31.074153900 CEST	49743	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:31.102833986 CEST	8234	49743	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:31.104394913 CEST	49743	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:31.184974909 CEST	8234	49743	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:31.440108061 CEST	8234	49743	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:31.541593075 CEST	49743	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:31.574187994 CEST	8234	49743	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:31.575355053 CEST	49743	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:31.603904009 CEST	8234	49743	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:31.604023933 CEST	49743	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:31.632771969 CEST	8234	49743	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:31.701618910 CEST	49743	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:31.802210093 CEST	8234	49743	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:31.943154097 CEST	49743	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:32.035202980 CEST	8234	49743	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:32.811266899 CEST	8234	49743	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:32.959044933 CEST	49743	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:32.959074020 CEST	49743	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:37.175744057 CEST	49749	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:37.204768896 CEST	8234	49749	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:37.204927921 CEST	49749	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:37.205801964 CEST	49749	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:37.257471085 CEST	8234	49749	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:37.270029068 CEST	49749	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:37.299228907 CEST	8234	49749	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:37.301058054 CEST	49749	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:37.375317097 CEST	8234	49749	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:37.534161091 CEST	8234	49749	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:37.535693884 CEST	49749	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:37.567775965 CEST	8234	49749	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:37.569590092 CEST	49749	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:37.598402977 CEST	8234	49749	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:37.598597050 CEST	49749	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:37.628292084 CEST	8234	49749	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:37.677659035 CEST	49749	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:37.764910936 CEST	49749	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:37.845264912 CEST	8234	49749	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:38.118846893 CEST	49749	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:38.196507931 CEST	8234	49749	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:39.116125107 CEST	49749	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:43.244412899 CEST	49750	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:43.274101019 CEST	8234	49750	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:43.274220943 CEST	49750	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:43.274912119 CEST	49750	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:43.336612940 CEST	8234	49750	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:43.337085962 CEST	49750	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:43.369898081 CEST	8234	49750	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:43.371495962 CEST	49750	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:43.449182034 CEST	8234	49750	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:43.705878019 CEST	8234	49750	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:43.710982084 CEST	49750	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:43.741163969 CEST	8234	49750	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:43.743252993 CEST	49750	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:43.772268057 CEST	8234	49750	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:43.772455931 CEST	49750	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:43.801592112 CEST	8234	49750	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:43.852391005 CEST	49750	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:43.901864052 CEST	49750	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:43.996131897 CEST	8234	49750	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:44.101079941 CEST	49750	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:44.186983109 CEST	8234	49750	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:45.086016893 CEST	49750	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:49.255630970 CEST	49751	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:49.284758091 CEST	8234	49751	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:49.284893990 CEST	49751	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:49.285712004 CEST	49751	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:49.329952955 CEST	8234	49751	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:49.330327034 CEST	49751	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:49.360291004 CEST	8234	49751	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:49.369986057 CEST	49751	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:49.473856926 CEST	8234	49751	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:49.657722950 CEST	8234	49751	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:49.706130981 CEST	49751	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:49.735888958 CEST	8234	49751	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:49.737313986 CEST	49751	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:49.766655922 CEST	8234	49751	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:49.769011021 CEST	49751	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:49.804266930 CEST	8234	49751	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:49.804598093 CEST	49751	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:49.895309925 CEST	8234	49751	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:50.085702896 CEST	49751	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:50.176938057 CEST	8234	49751	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:51.085913897 CEST	49751	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:51.366291046 CEST	49751	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:51.396306992 CEST	8234	49751	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:52.086210966 CEST	49751	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:56.167769909 CEST	49752	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:56.196454048 CEST	8234	49752	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:56.198208094 CEST	49752	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:56.199259043 CEST	49752	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:56.295098066 CEST	8234	49752	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:56.295196056 CEST	8234	49752	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:56.298388004 CEST	49752	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:56.376179934 CEST	8234	49752	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:56.376847982 CEST	49752	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:56.408174038 CEST	8234	49752	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:56.412332058 CEST	49752	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:56.499891996 CEST	8234	49752	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:56.851061106 CEST	8234	49752	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:56.852881908 CEST	49752	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:56.882944107 CEST	8234	49752	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:56.884936094 CEST	49752	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:56.915317059 CEST	8234	49752	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:56.915425062 CEST	49752	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:56.946609974 CEST	8234	49752	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:56.991714001 CEST	49752	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:57.066952944 CEST	49752	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:57.092442989 CEST	8234	49752	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:57.134110928 CEST	49752	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:57.144366980 CEST	8234	49752	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:57.195497990 CEST	49752	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:07:57.282814026 CEST	8234	49752	203.159.80.186	192.168.2.7
Aug 3, 2021 17:07:58.226843119 CEST	49752	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:02.455507040 CEST	49753	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:02.485275984 CEST	8234	49753	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:02.485493898 CEST	49753	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:02.487915993 CEST	49753	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:02.544874907 CEST	8234	49753	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:02.545198917 CEST	49753	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:02.579443932 CEST	8234	49753	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:02.580991983 CEST	49753	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:02.673430920 CEST	8234	49753	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:02.881875992 CEST	8234	49753	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:02.885284901 CEST	49753	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:02.917288065 CEST	8234	49753	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:02.921513081 CEST	49753	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:02.953090906 CEST	8234	49753	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:02.956645966 CEST	49753	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:02.988224983 CEST	8234	49753	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:03.019445896 CEST	49753	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:03.110241890 CEST	8234	49753	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:03.243483067 CEST	49753	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:03.326483965 CEST	8234	49753	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:04.243247986 CEST	49753	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:04.326639891 CEST	8234	49753	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:05.203648090 CEST	8234	49753	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:05.242993116 CEST	49753	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:09.622169018 CEST	49756	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:09.652043104 CEST	8234	49756	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:09.652157068 CEST	49756	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:09.673048973 CEST	49756	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:09.724513054 CEST	8234	49756	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:09.726010084 CEST	49756	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:09.759418011 CEST	8234	49756	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:09.762219906 CEST	49756	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:09.852384090 CEST	8234	49756	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:10.063718081 CEST	8234	49756	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:10.064599991 CEST	49756	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:10.094758034 CEST	8234	49756	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:10.095940113 CEST	49756	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:10.126723051 CEST	8234	49756	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:10.126945019 CEST	49756	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:10.156347036 CEST	8234	49756	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:10.211694002 CEST	49756	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:10.337296009 CEST	49756	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:10.419640064 CEST	8234	49756	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:11.353045940 CEST	49756	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:11.444211960 CEST	8234	49756	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:12.400043964 CEST	49756	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:16.500989914 CEST	49757	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:16.530553102 CEST	8234	49757	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:16.530796051 CEST	49757	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:16.531399012 CEST	49757	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:16.593184948 CEST	8234	49757	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:16.594063997 CEST	49757	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:16.624038935 CEST	8234	49757	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:16.625888109 CEST	49757	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:16.704998970 CEST	8234	49757	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:16.705122948 CEST	49757	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:16.792190075 CEST	8234	49757	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:16.988661051 CEST	8234	49757	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:16.990417957 CEST	49757	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:17.019299030 CEST	8234	49757	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:17.071683884 CEST	49757	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:17.666790009 CEST	49757	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:17.714317083 CEST	8234	49757	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:17.759059906 CEST	49757	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:17.787853003 CEST	8234	49757	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:17.791385889 CEST	49757	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:17.822164059 CEST	8234	49757	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:17.822379112 CEST	49757	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:17.852746964 CEST	8234	49757	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:17.899697065 CEST	49757	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:18.650876999 CEST	49757	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:22.729934931 CEST	49758	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:22.761147976 CEST	8234	49758	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:22.762411118 CEST	49758	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:22.795623064 CEST	49758	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:22.849622011 CEST	8234	49758	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:22.850121021 CEST	49758	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:22.880563974 CEST	8234	49758	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:22.882731915 CEST	49758	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:23.094213009 CEST	8234	49758	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:23.098165035 CEST	49758	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:23.135845900 CEST	8234	49758	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:23.181513071 CEST	49758	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:23.210546017 CEST	8234	49758	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:23.211153030 CEST	49758	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:23.240161896 CEST	8234	49758	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:23.240397930 CEST	49758	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:23.270136118 CEST	8234	49758	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:23.322202921 CEST	49758	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:23.776185036 CEST	49758	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:23.866684914 CEST	8234	49758	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:24.745383024 CEST	49758	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:28.842664003 CEST	49759	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:28.871329069 CEST	8234	49759	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:28.871474981 CEST	49759	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:28.872469902 CEST	49759	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:28.927962065 CEST	8234	49759	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:28.965029001 CEST	49759	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:28.994873047 CEST	8234	49759	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:29.041256905 CEST	49759	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:29.067025900 CEST	49759	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:29.146749973 CEST	8234	49759	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:29.562422991 CEST	8234	49759	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:29.563651085 CEST	49759	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:29.593547106 CEST	8234	49759	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:29.635425091 CEST	49759	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:29.667346001 CEST	8234	49759	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:29.713176012 CEST	49759	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:29.718251944 CEST	49759	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:29.748380899 CEST	8234	49759	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:29.748606920 CEST	49759	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:29.779402018 CEST	8234	49759	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:29.779689074 CEST	49759	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:29.808800936 CEST	8234	49759	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:29.853967905 CEST	49759	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:29.883708000 CEST	8234	49759	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:29.932120085 CEST	49759	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:30.745222092 CEST	49759	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:34.823502064 CEST	49760	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:34.853494883 CEST	8234	49760	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:34.853648901 CEST	49760	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:34.856930017 CEST	49760	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:34.906431913 CEST	8234	49760	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:34.906913996 CEST	49760	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:34.936635017 CEST	8234	49760	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:34.938385010 CEST	49760	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:35.025913954 CEST	8234	49760	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:35.438770056 CEST	8234	49760	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:35.440076113 CEST	49760	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:35.469183922 CEST	8234	49760	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:35.510544062 CEST	49760	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:35.542313099 CEST	8234	49760	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:35.542912960 CEST	49760	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:35.575583935 CEST	8234	49760	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:35.575654984 CEST	49760	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:35.606777906 CEST	8234	49760	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:35.651261091 CEST	49760	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:35.746001959 CEST	49760	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:35.838310003 CEST	8234	49760	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:37.544517994 CEST	8234	49760	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:37.588884115 CEST	49760	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:39.901520967 CEST	8234	49760	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:39.948426008 CEST	49760	8234	192.168.2.7	203.159.80.186
Aug 3, 2021 17:08:44.917691946 CEST	8234	49760	203.159.80.186	192.168.2.7
Aug 3, 2021 17:08:44.964485884 CEST	49760	8234	192.168.2.7	203.159.80.186

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 3, 2021 17:06:21.542763948 CEST	56590	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:21.571151018 CEST	53	56590	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:22.590699911 CEST	60501	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:22.618423939 CEST	53	60501	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:23.600570917 CEST	53775	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:23.626568079 CEST	53	53775	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:24.638501883 CEST	51837	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:24.671672106 CEST	53	51837	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:26.135978937 CEST	55411	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:26.164107084 CEST	53	55411	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:27.495162010 CEST	63668	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:27.527815104 CEST	53	63668	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:28.636183023 CEST	54640	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:28.668950081 CEST	53	54640	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:29.894224882 CEST	58739	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:29.929974079 CEST	53	58739	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:31.288849115 CEST	60338	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:31.316510916 CEST	53	60338	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:32.746481895 CEST	58717	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:32.773911953 CEST	53	58717	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:35.052634954 CEST	59762	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:35.077202082 CEST	53	59762	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:36.071739912 CEST	54329	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:36.102565050 CEST	53	54329	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:37.123631001 CEST	58052	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:37.151098013 CEST	53	58052	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:38.190502882 CEST	54008	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:38.225246906 CEST	53	54008	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:39.252865076 CEST	59451	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:39.285063982 CEST	53	59451	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:39.957365990 CEST	52914	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:39.991733074 CEST	53	52914	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:41.237966061 CEST	64569	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:41.265094995 CEST	52816	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:41.265448093 CEST	53	64569	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:41.395359993 CEST	53	52816	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:42.283556938 CEST	50781	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:42.315649986 CEST	53	50781	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:43.006484985 CEST	54230	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:43.031563997 CEST	53	54230	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:43.664462090 CEST	54911	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:43.690613031 CEST	53	54911	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:46.775603056 CEST	49958	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:46.811254978 CEST	53	49958	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:48.393317938 CEST	50860	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:48.524399996 CEST	53	50860	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:50.426842928 CEST	50452	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:50.462388992 CEST	53	50452	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:54.451605082 CEST	59730	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:54.484944105 CEST	53	59730	8.8.8.8	192.168.2.7
Aug 3, 2021 17:06:54.889625072 CEST	59310	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:06:54.923458099 CEST	53	59310	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:00.969794989 CEST	51919	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:01.004370928 CEST	53	51919	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:07.044657946 CEST	64296	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:07.080137014 CEST	53	64296	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:12.698101997 CEST	56680	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:12.732578993 CEST	53	56680	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:18.692414045 CEST	58820	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:18.732935905 CEST	53	58820	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:18.848773003 CEST	60983	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:18.882757902 CEST	53	60983	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:19.188673019 CEST	49247	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:19.221285105 CEST	53	49247	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:19.272763968 CEST	52286	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:19.307548046 CEST	53	52286	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:19.954912901 CEST	56064	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:20.017827988 CEST	53	56064	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:20.513102055 CEST	63744	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:20.548520088 CEST	53	63744	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:21.143942118 CEST	61457	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:21.179691076 CEST	53	61457	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:21.657195091 CEST	58367	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:21.692867994 CEST	53	58367	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:22.437619925 CEST	60599	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:22.470551014 CEST	53	60599	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:23.949278116 CEST	59571	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:23.984989882 CEST	53	59571	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:24.825263023 CEST	52689	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:24.858367920 CEST	53	52689	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:25.584248066 CEST	50290	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:25.617404938 CEST	53	50290	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:26.557281017 CEST	60427	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:26.591330051 CEST	53	60427	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:30.959038019 CEST	56209	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:30.991909981 CEST	53	56209	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:31.709007025 CEST	59582	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:31.752811909 CEST	53	59582	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:37.138364077 CEST	60949	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:37.173894882 CEST	53	60949	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:43.207992077 CEST	58542	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:43.240693092 CEST	53	58542	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:49.125431061 CEST	59179	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:49.254106998 CEST	53	59179	8.8.8.8	192.168.2.7
Aug 3, 2021 17:07:56.132236004 CEST	60927	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:07:56.166098118 CEST	53	60927	8.8.8.8	192.168.2.7
Aug 3, 2021 17:08:02.321283102 CEST	57854	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:08:02.454139948 CEST	53	57854	8.8.8.8	192.168.2.7
Aug 3, 2021 17:08:03.787842035 CEST	62026	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:08:03.835972071 CEST	53	62026	8.8.8.8	192.168.2.7
Aug 3, 2021 17:08:06.960706949 CEST	59453	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:08:07.011775970 CEST	53	59453	8.8.8.8	192.168.2.7
Aug 3, 2021 17:08:09.583043098 CEST	62468	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:08:09.619055033 CEST	53	62468	8.8.8.8	192.168.2.7
Aug 3, 2021 17:08:16.466579914 CEST	52563	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:08:16.499321938 CEST	53	52563	8.8.8.8	192.168.2.7
Aug 3, 2021 17:08:22.695369959 CEST	54721	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:08:22.728216887 CEST	53	54721	8.8.8.8	192.168.2.7
Aug 3, 2021 17:08:28.805661917 CEST	62826	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:08:28.840946913 CEST	53	62826	8.8.8.8	192.168.2.7
Aug 3, 2021 17:08:34.787343025 CEST	62046	53	192.168.2.7	8.8.8.8
Aug 3, 2021 17:08:34.821742058 CEST	53	62046	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 3, 2021 17:06:41.265094995 CEST	192.168.2.7	8.8.8.8	0xcfe7	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:06:48.393317938 CEST	192.168.2.7	8.8.8.8	0x7cdd	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:06:54.889625072 CEST	192.168.2.7	8.8.8.8	0x11f3	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:00.969794989 CEST	192.168.2.7	8.8.8.8	0x402a	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:07.044657946 CEST	192.168.2.7	8.8.8.8	0xfdca	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:12.698101997 CEST	192.168.2.7	8.8.8.8	0x22a8	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:18.848773003 CEST	192.168.2.7	8.8.8.8	0xe20e	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:24.825263023 CEST	192.168.2.7	8.8.8.8	0xa8bd	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:30.959038019 CEST	192.168.2.7	8.8.8.8	0x6954	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:37.138364077 CEST	192.168.2.7	8.8.8.8	0xc73b	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:43.207992077 CEST	192.168.2.7	8.8.8.8	0x73b	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:49.125431061 CEST	192.168.2.7	8.8.8.8	0x93cf	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:56.132236004 CEST	192.168.2.7	8.8.8.8	0x9baa	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:08:02.321283102 CEST	192.168.2.7	8.8.8.8	0x992f	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:08:09.583043098 CEST	192.168.2.7	8.8.8.8	0xef63	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:08:16.466579914 CEST	192.168.2.7	8.8.8.8	0xf44b	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:08:22.695369959 CEST	192.168.2.7	8.8.8.8	0xa8b4	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:08:28.805661917 CEST	192.168.2.7	8.8.8.8	0x812	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)
Aug 3, 2021 17:08:34.787343025 CEST	192.168.2.7	8.8.8.8	0x4c87	Standard query (0)	hhjhtggfr.duckdns.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Aug 3, 2021 17:06:41.395359993 CEST	8.8.8.8	192.168.2.7	0xcfe7	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:06:48.524399996 CEST	8.8.8.8	192.168.2.7	0x7cdd	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:06:54.923458099 CEST	8.8.8.8	192.168.2.7	0x11f3	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:01.004370928 CEST	8.8.8.8	192.168.2.7	0x402a	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:07.080137014 CEST	8.8.8.8	192.168.2.7	0xfdca	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:12.732578993 CEST	8.8.8.8	192.168.2.7	0x22a8	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:18.882757902 CEST	8.8.8.8	192.168.2.7	0xe20e	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:24.858367920 CEST	8.8.8.8	192.168.2.7	0xa8bd	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:30.991909981 CEST	8.8.8.8	192.168.2.7	0x6954	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:37.173894882 CEST	8.8.8.8	192.168.2.7	0xc73b	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:43.240693092 CEST	8.8.8.8	192.168.2.7	0x73b	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:49.254106998 CEST	8.8.8.8	192.168.2.7	0x93cf	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:07:56.166098118 CEST	8.8.8.8	192.168.2.7	0x9baa	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:08:02.454139948 CEST	8.8.8.8	192.168.2.7	0x992f	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:08:09.619055033 CEST	8.8.8.8	192.168.2.7	0xef63	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:08:16.499321938 CEST	8.8.8.8	192.168.2.7	0xf44b	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:08:22.728216887 CEST	8.8.8.8	192.168.2.7	0xa8b4	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:08:28.840946913 CEST	8.8.8.8	192.168.2.7	0x812	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)
Aug 3, 2021 17:08:34.821742058 CEST	8.8.8.8	192.168.2.7	0x4c87	No error (0)	hhjhtggfr.duckdns.org	203.159.80.186	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: vHLZ6AHJFY.exe PID: 4640 Parent PID: 5608

General

Start time:	17:06:30
Start date:	03/08/2021
Path:	C:\Users\user\Desktop\vHLZ6AHJFY.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\vHLZ6AHJFY.exe'
Imagebase:	0xf0000
File size:	835072 bytes
MD5 hash:	E7F52D9D50E6D2776D301B5A7E03B662
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.243870600.00000000026DB000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.246214384.0000000003559000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.246214384.0000000003559000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.246214384.0000000003559000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: vHLZ6AHJFY.exe PID: 4832 Parent PID: 4640

General

Start time:	17:06:37
Start date:	03/08/2021
Path:	C:\Users\user\Desktop\vHLZ6AHJFY.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\vHLZ6AHJFY.exe
Imagebase:	0x490000
File size:	835072 bytes
MD5 hash:	E7F52D9D50E6D2776D301B5A7E03B662
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: dhcpmon.exe PID: 2680 Parent PID: 3292

General

Start time:	17:06:53
Start date:	03/08/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Imagebase:	0x50000
File size:	835072 bytes
MD5 hash:	E7F52D9D50E6D2776D301B5A7E03B662
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000005.00000002.296482527.000000000256B000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000005.00000002.302655095.00000000033E9000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000005.00000002.302655095.00000000033E9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000005.00000002.302655095.00000000033E9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 22%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: dhcpmon.exe PID: 5008 Parent PID: 2680

General

Start time:	17:06:59
Start date:	03/08/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Imagebase:	0x340000
File size:	835072 bytes
MD5 hash:	E7F52D9D50E6D2776D301B5A7E03B662
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: dhcpmon.exe PID: 6008 Parent PID: 2680

General

Start time:	17:07:00
Start date:	03/08/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Imagebase:	0xbc0000
File size:	835072 bytes
MD5 hash:	E7F52D9D50E6D2776D301B5A7E03B662
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000D.00000002.316057670.0000000002F21000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000D.00000002.316057670.0000000002F21000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000D.00000002.315036949.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000D.00000002.315036949.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000D.00000002.315036949.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000D.00000002.316141333.0000000003F29000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000D.00000002.316141333.0000000003F29000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: vHLZ6AHJFY.exe PID: 4640 Parent PID: 5608 vHLZ6AHJFY.exeCOMMON

Executed Functions

Function 00A66B80, Relevance: 6.1, APIs: 4, Instructions: 125threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00A66BF0
GetCurrentThread.KERNEL32 ref: 00A66C2D
GetCurrentProcess.KERNEL32 ref: 00A66C6A
GetCurrentThreadId.KERNEL32 ref: 00A66CC3

Memory Dump Source

Source File: 00000000.00000002.243239898.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 524439edc9f94387bb0b7b6a75d2adf01bbf3fe09164cebe301df6ed375db113
Instruction ID: b8eeb242c000a56d3611468b6f47876acc1e9fbd343880c21d2d78c9d9ec5f3e
Opcode Fuzzy Hash: 524439edc9f94387bb0b7b6a75d2adf01bbf3fe09164cebe301df6ed375db113
Instruction Fuzzy Hash: F45154B49006498FDB14CFAAD988BDEBBF0FF88304F24806AE459A7260D7745945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00A66B90, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00A66BF0
GetCurrentThread.KERNEL32 ref: 00A66C2D
GetCurrentProcess.KERNEL32 ref: 00A66C6A
GetCurrentThreadId.KERNEL32 ref: 00A66CC3

Memory Dump Source

Source File: 00000000.00000002.243239898.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1cfdff903214bb505859b1c1de3bac9d10d2ea013ccae98128119b78f233d54a
Instruction ID: cd941151cdb767c18155e1981ea11a0fbcc708ec230b6fdb43bcbc39279749ff
Opcode Fuzzy Hash: 1cfdff903214bb505859b1c1de3bac9d10d2ea013ccae98128119b78f233d54a
Instruction Fuzzy Hash: 8D5146B09006498FDB14CFAAD588BDEBBF0FF48304F208459E459A7350D7746944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00A6BBB8, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 200COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00A6BE0E

Strings

4mx, xrefs: 00A6BD6B
4mx, xrefs: 00A6BD46

Memory Dump Source

Source File: 00000000.00000002.243239898.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false

Similarity

API ID: HandleModule
String ID: 4mx$4mx
API String ID: 4139908857-1043820660
Opcode ID: 44780aff2f1b5a0adbf1aff323757f4929ebc8934d529e75d295b48e8264650d
Instruction ID: ee1bccbbddfff0bffdc5b710a549284d44270394c852d1b231f8f5cffc97ac75
Opcode Fuzzy Hash: 44780aff2f1b5a0adbf1aff323757f4929ebc8934d529e75d295b48e8264650d
Instruction Fuzzy Hash: A97134B0A10B058FDB24DF2AC55575ABBF1FF88304F00892DD58ADBA50DB35E946CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A6DC78, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00A6DD8A

Memory Dump Source

Source File: 00000000.00000002.243239898.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: dc55180650e2155ca7c29632bbe1369db56ef9882bd233aaa3e615aee98a87ca
Instruction ID: c374b90cea806544e5997978d29fa17b1d3f4c73599b3369597af62ee7b6725f
Opcode Fuzzy Hash: dc55180650e2155ca7c29632bbe1369db56ef9882bd233aaa3e615aee98a87ca
Instruction Fuzzy Hash: B841B0B1D00309EFDF14DFA9C884ADEBBB5BF88354F24812AE819AB210D7759945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00A66D41, Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A66E3F

Memory Dump Source

Source File: 00000000.00000002.243239898.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: db69fc8ab5b6bfd84c2843c13fc0cbab724a020709d968aca89b748585d0d020
Instruction ID: 352decfadecb998e4b757772d96b2652e7f7334179380a9cee8709c85dcdb225
Opcode Fuzzy Hash: db69fc8ab5b6bfd84c2843c13fc0cbab724a020709d968aca89b748585d0d020
Instruction Fuzzy Hash: E04168B6900248AFCF11CF99D884AEEBFF5EB88310F14806AE944A7360C3359915CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A66DB0, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A66E3F

Memory Dump Source

Source File: 00000000.00000002.243239898.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fff880f93866991a9dfeec50fc93c23e916e88baae11e59f954cad2ca42002ba
Instruction ID: 8da5ba4ca4d7e5b61446fa3c79651b8dc18b3f83e542ec186a10625d6635a8ba
Opcode Fuzzy Hash: fff880f93866991a9dfeec50fc93c23e916e88baae11e59f954cad2ca42002ba
Instruction Fuzzy Hash: 502103B59002089FDB10CFA9D884AEEFBF4FF48320F14801AE954A7310D375A955CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A66DB8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A66E3F

Memory Dump Source

Source File: 00000000.00000002.243239898.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4075ae129c6d67d211ce857f5d1e8a6b81ac0ebc00a80f7abf57013bfbfcb690
Instruction ID: be9c013772a5090cf2db27c347329ef5b6e529de2250bcfb8ed589b21642fe98
Opcode Fuzzy Hash: 4075ae129c6d67d211ce857f5d1e8a6b81ac0ebc00a80f7abf57013bfbfcb690
Instruction Fuzzy Hash: 0821E4B59003089FDB10CFA9D884BEEBBF8FB48320F14801AE914A7310D375A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A6B0D8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00A6BE89,00000800,00000000,00000000), ref: 00A6C09A

Memory Dump Source

Source File: 00000000.00000002.243239898.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 78260b69eb0c4e1a2fe9d47aab6f05c51b32b7108b741c1d99ba1dadb5abdb63
Instruction ID: b534e720f4834add3824a9286c666cd4264cf3600fb331d40b10b5f3645f2d5f
Opcode Fuzzy Hash: 78260b69eb0c4e1a2fe9d47aab6f05c51b32b7108b741c1d99ba1dadb5abdb63
Instruction Fuzzy Hash: C11106B2904349CFCB20CF9AD444BAEFBF4AB88324F11842EE555A7200C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A6C028, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00A6BE89,00000800,00000000,00000000), ref: 00A6C09A

Memory Dump Source

Source File: 00000000.00000002.243239898.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f62558778e43b851e4e3941e0cd0903680afb42d54f06605b44b159fa0ba1203
Instruction ID: 66ae66467da663b23cd1bc3f37fcf7f6cf6eb95a11d82e17f4796e7d55691e6c
Opcode Fuzzy Hash: f62558778e43b851e4e3941e0cd0903680afb42d54f06605b44b159fa0ba1203
Instruction Fuzzy Hash: 741114B6C00349CFDB24CF9AD484BEEFBF4AB88324F15852AD455A7200C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A6BDA8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00A6BE0E

Memory Dump Source

Source File: 00000000.00000002.243239898.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 17fe211cbdd45f40ea1b553bacc63240109856b720cd90b6941cb70d3b4909b0
Instruction ID: 2149e3ca0f404fea7341841443f527828e7e43207c1a584509ddeb27fa96022e
Opcode Fuzzy Hash: 17fe211cbdd45f40ea1b553bacc63240109856b720cd90b6941cb70d3b4909b0
Instruction Fuzzy Hash: 1A11D2B6C006498FCB10CF9AC444BDEFBF4EB88324F14845AD969A7600C379A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A6DEC0, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 00A6DF1D

Memory Dump Source

Source File: 00000000.00000002.243239898.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 8981f831216e9b9009413ef6d99ade333068bb4677526aabb43ab8648f8958ff
Instruction ID: e2206aaf33f50dc1bc22b9fd47cd394c303dcac8b5176c0c8d92a3a6a66af2c1
Opcode Fuzzy Hash: 8981f831216e9b9009413ef6d99ade333068bb4677526aabb43ab8648f8958ff
Instruction Fuzzy Hash: BD11D0B59002499FDB10CF9AD588BDEBBF8EB88324F10845AE959A7600C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0078D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.242953054.000000000078D000.00000040.00000001.sdmp, Offset: 0078D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 741a9c502663439a743eaf37f0b0dd72c820d103188ce8cb260a8d82347e6f0b
Instruction ID: 348ab70bc2973870eba098a806629b301cb7e8d91783c0cde9bd2526c966b5e2
Opcode Fuzzy Hash: 741a9c502663439a743eaf37f0b0dd72c820d103188ce8cb260a8d82347e6f0b
Instruction Fuzzy Hash: B221F5B1588344DFDB24EF14D9C4B26BB65FB88324F24C569D9494B286C33ADC46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0078D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.242953054.000000000078D000.00000040.00000001.sdmp, Offset: 0078D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f442e12a0ed85cfe1762be029f9334f1e608e9f993b798becb561f8831fe14b
Instruction ID: 6e2fe59541919f7a5495822346d7020c1d83b32346b69b4bb81ace93995b7058
Opcode Fuzzy Hash: 6f442e12a0ed85cfe1762be029f9334f1e608e9f993b798becb561f8831fe14b
Instruction Fuzzy Hash: 472107B1588244DFDB15EF54D9C4F26BBA5FB88324F24C569E9094B282C33ADC46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0078D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.242953054.000000000078D000.00000040.00000001.sdmp, Offset: 0078D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140eabb80c80f3bcf642b4b34e196c70f529ea9b94f5b972a75821fe3ac4ed61
Instruction ID: 37704266f578c76046663b190622c881b169f8b908eaba4e5f3077438652d577
Opcode Fuzzy Hash: 140eabb80c80f3bcf642b4b34e196c70f529ea9b94f5b972a75821fe3ac4ed61
Instruction Fuzzy Hash: DE119D75944280DFCB11DF14D5C4B15FBB1FB84324F28C6ADD8494B696C33AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0078D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.242953054.000000000078D000.00000040.00000001.sdmp, Offset: 0078D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140eabb80c80f3bcf642b4b34e196c70f529ea9b94f5b972a75821fe3ac4ed61
Instruction ID: 46dd96d6f0dfb21d16782382bf2011b32e91818ed2cfce370f58cb52e4bc120e
Opcode Fuzzy Hash: 140eabb80c80f3bcf642b4b34e196c70f529ea9b94f5b972a75821fe3ac4ed61
Instruction Fuzzy Hash: B311D075548280CFCB11DF10D5C4B15FB71FB48324F24C6A9D8494B696C33AD84ACBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000F4C65, Relevance: 3.5, Instructions: 3474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.242593423.00000000000F2000.00000002.00020000.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.242585861.00000000000F0000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84788326d140bcfde10dc07da9d92289429e532c9b23f0d54c49f940813853a
Instruction ID: e0f3ff24f4b89d73b0bc32185bbf724ecd8b2805c7525715c084f0b6eb90e5f5
Opcode Fuzzy Hash: d84788326d140bcfde10dc07da9d92289429e532c9b23f0d54c49f940813853a
Instruction Fuzzy Hash: E143F00104FBC21FD7038BB82D316E6BFB66E9322434E44C7D9C08B9A3D5055A69E776

Uniqueness

Uniqueness Score: -1.00%

Function 00A6C2B0, Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243239898.0000000000A60000.00000040.00000001.sdmp, Offset: 00A60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f9aecb0eee588d5587ed95c0ab9d42ff497068c37d5bd2008be3befdde3b14
Instruction ID: 4090b3f25dd9f4a2944e49342b20514d9195163ae22a9ccb4900b2982e650bb7
Opcode Fuzzy Hash: 62f9aecb0eee588d5587ed95c0ab9d42ff497068c37d5bd2008be3befdde3b14
Instruction Fuzzy Hash: 2A5238B1501B46CBD720CF96EC983AD7BB1FB44328FA04318D2A15BAA2D7F4654ADF44

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dhcpmon.exe PID: 2680 Parent PID: 3292 dhcpmon.exeCOMMON

Executed Functions

Function 06983680, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.311516315.0000000006980000.00000040.00000001.sdmp, Offset: 06980000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d12bd52ce20f8416c245573c49ebda5086b4a3555cca758f9744ac8783fd2061
Instruction ID: 0e6c52f3978c07b4a8384320454b41356a91195c92e1e37c9eea354d0cb284e5
Opcode Fuzzy Hash: d12bd52ce20f8416c245573c49ebda5086b4a3555cca758f9744ac8783fd2061
Instruction Fuzzy Hash: 1D215574E15219DFEB50EFA9D854BEEBBF8AF4A701F24542AE405F3640EB34C940CA64

Uniqueness

Uniqueness Score: -1.00%

Function 06983671, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.311516315.0000000006980000.00000040.00000001.sdmp, Offset: 06980000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a783bc8eb97e69a19423ac1a96a6b44e62113cdfc9e2a8e6b208d8e41da2a2
Instruction ID: b78b2b035bfabc8295ec43eb4123afd7c07ca8e876c98bccb421abc323a89e90
Opcode Fuzzy Hash: 52a783bc8eb97e69a19423ac1a96a6b44e62113cdfc9e2a8e6b208d8e41da2a2
Instruction Fuzzy Hash: 80213370E11219AFDB51DFA8D898BEEBBF5AB0A700F244429E441F3680D738C944CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00C1BBB8, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 197COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C1BE0E

Strings

AAABAC4AAAABAC4AAAABAC4AAAABAC4AAAABAAwEAAACABEEAAADABYEAAABAAwEAAACABEEAAADABYEAAABAEgEAAABAEgEAAABAEgEAAABAKEEAAABAKEEAAABAKEEAA, xrefs: 00C1BC60
4mn, xrefs: 00C1BD6B
4mn, xrefs: 00C1BD46

Memory Dump Source

Source File: 00000005.00000002.293270772.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID: HandleModule
String ID: 4mn$4mn$AAABAC4AAAABAC4AAAABAC4AAAABAC4AAAABAAwEAAACABEEAAADABYEAAABAAwEAAACABEEAAADABYEAAABAEgEAAABAEgEAAABAEgEAAABAKEEAAABAKEEAAABAKEEAA
API String ID: 4139908857-690385783
Opcode ID: 45af586c5f4f7397e4133f4c51695ed2fb567c16f9283e456a7083b7ba7c2109
Instruction ID: 156e83037cfebf2515df3f58eddd9702fbf924bef8f2bd859e11dfa2efd73dc8
Opcode Fuzzy Hash: 45af586c5f4f7397e4133f4c51695ed2fb567c16f9283e456a7083b7ba7c2109
Instruction Fuzzy Hash: 947125B0A00B058FD724DF2AD45179ABBF1BF89304F00892DE59ADBA40DB34E9458F91

Uniqueness

Uniqueness Score: -1.00%

Function 06980006, Relevance: 1.8, APIs: 1, Instructions: 270processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06980276

Memory Dump Source

Source File: 00000005.00000002.311516315.0000000006980000.00000040.00000001.sdmp, Offset: 06980000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 0f19ed42d6e7b2636b187317ef77568fac00b8b9e37cec576656a0a5949bfafd
Instruction ID: b75e922eb3cd42649740bdfad99f3267d607e25173681d4da3cb5f95b39628b1
Opcode Fuzzy Hash: 0f19ed42d6e7b2636b187317ef77568fac00b8b9e37cec576656a0a5949bfafd
Instruction Fuzzy Hash: 55A1CB30D04359CFDB11DFA4C880BDEBBB2AF49314F1581AAE848A7690DB749989CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06980040, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06980276

Memory Dump Source

Source File: 00000005.00000002.311516315.0000000006980000.00000040.00000001.sdmp, Offset: 06980000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 197bcc0cfba95966c5611fc6bec383eb45c54964879674b699f00ba8b57fbcf5
Instruction ID: 8e8800462a18f563a9731be7376c8b54d4443a665ebbe4296cc1f5f669a9865f
Opcode Fuzzy Hash: 197bcc0cfba95966c5611fc6bec383eb45c54964879674b699f00ba8b57fbcf5
Instruction Fuzzy Hash: 6F915971D00219CFDF60DFA8C880BDEBAB2BF48314F158569E859A7680DB749989CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B214, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00C1DD8A

Memory Dump Source

Source File: 00000005.00000002.293270772.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f56964a1afae890e969fc53f0d45ca23ba1b4938065aa9f5d32fb60024a78431
Instruction ID: 9f02c0eed47a5288a4473312ffe9d87bdbd69c0f43684bede5268abba138f342
Opcode Fuzzy Hash: f56964a1afae890e969fc53f0d45ca23ba1b4938065aa9f5d32fb60024a78431
Instruction Fuzzy Hash: 6B51D1B1D00349EFDF14CF99D884ADEBBB5BF49310F24852AE819AB210D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C1DC6D, Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00C1DD8A

Memory Dump Source

Source File: 00000005.00000002.293270772.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6117dc9735a1504b81b9900590b91f2efc78f16611751d30036a681b2dc31b5e
Instruction ID: 538a06c8053e8d0fd813a8de6b03eb4ae90e7a1de524605b690c7ee4ddb65680
Opcode Fuzzy Hash: 6117dc9735a1504b81b9900590b91f2efc78f16611751d30036a681b2dc31b5e
Instruction Fuzzy Hash: 4751D0B1D00349EFDF14DF9AD884ADEBBB1BF48314F24812AE819AB210D7749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C16D41, Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C16E3F

Memory Dump Source

Source File: 00000005.00000002.293270772.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 05bb0ca931898d6577b507548acc5491eeb5ace5b24200a955aba84c5b49dff8
Instruction ID: 8d9d2eeb73cd25e826b80680f72f54f2fc08af72946810b8ab61b89310164567
Opcode Fuzzy Hash: 05bb0ca931898d6577b507548acc5491eeb5ace5b24200a955aba84c5b49dff8
Instruction Fuzzy Hash: 474159769002589FCF01CF99D884ADEBFF5EB49320F14802AE954E7261D3349955DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1DE81, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 00C1DF1D

Memory Dump Source

Source File: 00000005.00000002.293270772.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 0292ad1bf7116a5061f695b530acbdafc8bbbfaca0dc74fd9bda96c8d9691af6
Instruction ID: fdcf1c70981a7a30e7290b9f5cff5f1cac0ef5a5ac2bb009acec7a9bea84e567
Opcode Fuzzy Hash: 0292ad1bf7116a5061f695b530acbdafc8bbbfaca0dc74fd9bda96c8d9691af6
Instruction Fuzzy Hash: EE21A9B5800249DFDB10CFA4D488BDEBFF4EF89324F08805AE419AB211C334AA45DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C16DB0, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C16E3F

Memory Dump Source

Source File: 00000005.00000002.293270772.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 22bab4171af813491aa4f8683f353ed1d201f0514d21b493dbbea48961ecbea1
Instruction ID: 1eac605a9d70c8dcceffc50c0e9f3b3d83ca42f709b8663dd8f51500b3effef0
Opcode Fuzzy Hash: 22bab4171af813491aa4f8683f353ed1d201f0514d21b493dbbea48961ecbea1
Instruction Fuzzy Hash: E021D2B59012499FDB10CFA9D884ADEBBF4EF48324F14842AE914A7250D378AA55CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C16DB8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C16E3F

Memory Dump Source

Source File: 00000005.00000002.293270772.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d65dadf9e7fbebef111c743ce5bcbf4639bc59e6f95556c8804d441b89cf8fed
Instruction ID: f337ac1da7be9f3693d274f3e637bfea894055fcae0d17b67272c290c21711a0
Opcode Fuzzy Hash: d65dadf9e7fbebef111c743ce5bcbf4639bc59e6f95556c8804d441b89cf8fed
Instruction Fuzzy Hash: 4721C4B59002499FDF10CFA9D884ADEBBF8FF48324F14851AE914A7310D374AA54CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B0D8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C1BE89,00000800,00000000,00000000), ref: 00C1C09A

Memory Dump Source

Source File: 00000005.00000002.293270772.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 592037ddeb73d4077b3d962837629a3f6faca759704968706352c7d78e4ecb73
Instruction ID: 4cbf86293bb456503f70f08557c4c072c58b3cc712200fb9260d8de8f7824268
Opcode Fuzzy Hash: 592037ddeb73d4077b3d962837629a3f6faca759704968706352c7d78e4ecb73
Instruction Fuzzy Hash: 921106B6900309DFDB10CF9AC484BDEFBF4AB49354F14852AE515A7200C375AA45CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C1C028, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C1BE89,00000800,00000000,00000000), ref: 00C1C09A

Memory Dump Source

Source File: 00000005.00000002.293270772.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c545abf69108d57189594e685cc8148f191e7acd29030c4fc88f50a8b5906bd5
Instruction ID: e99aed4157b476b5269bf457b83e56bc1abdd6024a5462a6c605f4613740ebf7
Opcode Fuzzy Hash: c545abf69108d57189594e685cc8148f191e7acd29030c4fc88f50a8b5906bd5
Instruction Fuzzy Hash: 1B1106B69003099FCB10CF9AC484BDEFBF4EB49324F15852AE519A7200C375AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06983058, Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 069830BD

Memory Dump Source

Source File: 00000005.00000002.311516315.0000000006980000.00000040.00000001.sdmp, Offset: 06980000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ee0d6a4cc8dd6124e634386dccbdde047d6046ed2136be8dc0485c5545b47cca
Instruction ID: a1f82b385e841fb81bbedc394d32c229d20dd577207243a18b6ed7dc74c6c8e4
Opcode Fuzzy Hash: ee0d6a4cc8dd6124e634386dccbdde047d6046ed2136be8dc0485c5545b47cca
Instruction Fuzzy Hash: 0A11F2B68003499FDB10DF99D885BDEBBF8EB48364F10841AE459A7600D375AA85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1BDA8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C1BE0E

Memory Dump Source

Source File: 00000005.00000002.293270772.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d643ec3068cb434f50e3063157094be85ee8381f172a25bc8b0526f1e247e9eb
Instruction ID: 2e9b4e8dd9e5155795b1a4abe313857b46180764e9f464c5e7f595a8a9265a19
Opcode Fuzzy Hash: d643ec3068cb434f50e3063157094be85ee8381f172a25bc8b0526f1e247e9eb
Instruction Fuzzy Hash: 2111E3B5D006498FDB10CF9AD444BDEFBF4EF89324F14855AD529A7600C374AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1DEC0, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 00C1DF1D

Memory Dump Source

Source File: 00000005.00000002.293270772.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 2528783c5796c2b64452e57ac8afaf107097451e68d224bc0121c170f804339d
Instruction ID: 23855a4bdc1102e2e8ee6a3b6d7a8b5e9a092a10dd5451ee84546b7cbee86e4e
Opcode Fuzzy Hash: 2528783c5796c2b64452e57ac8afaf107097451e68d224bc0121c170f804339d
Instruction Fuzzy Hash: 3811E5B58002499FDB10CF99D484BDEFBF8EB49324F14851AE955A7700C374AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06983060, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 069830BD

Memory Dump Source

Source File: 00000005.00000002.311516315.0000000006980000.00000040.00000001.sdmp, Offset: 06980000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 0d08fc0a9743a719112801671bf4859906a72f74906f8a8acff439169a92ac53
Instruction ID: d6d81ecf3a2bd8eb836214cc7dce98990a334f07f274e1cd554aeeef637bafd8
Opcode Fuzzy Hash: 0d08fc0a9743a719112801671bf4859906a72f74906f8a8acff439169a92ac53
Instruction Fuzzy Hash: 8B11D3B58003499FDB10DF99D884BDEBBF8EB48324F148459E555A7600C375AA84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 006DD4D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.291589884.00000000006DD000.00000040.00000001.sdmp, Offset: 006DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee436d51eff081b4daa1bab19b2cd33866105f4bf41f94d56dd553eec8bbded8
Instruction ID: 827e4f0dbba42893885f7c4c28f197ae08a5fccf3fdee4d2f733b8dcf0ea50ac
Opcode Fuzzy Hash: ee436d51eff081b4daa1bab19b2cd33866105f4bf41f94d56dd553eec8bbded8
Instruction Fuzzy Hash: E72128B1904244DFCB14EF14E9C0F26BBA6FB88328F24856AE9054B346C336DC56CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 006ED01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.291645597.00000000006ED000.00000040.00000001.sdmp, Offset: 006ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b18e0d06a78167ac9b39003ec345654c6f805972789d4e728802208d23d671
Instruction ID: ce1badb36cfabca77a920788aec29caa2916ee971b5f35a9f945f4c04420f4f9
Opcode Fuzzy Hash: 54b18e0d06a78167ac9b39003ec345654c6f805972789d4e728802208d23d671
Instruction Fuzzy Hash: 6D21C2B5508384DFDB14DF14D9C4B26BBA6FB88314F38C569E94A4B346C33AD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 006ED1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.291645597.00000000006ED000.00000040.00000001.sdmp, Offset: 006ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4823ef9808b37ada3f23253a2a5718a39e00c7bdc2e51d906f976cf9278fd8
Instruction ID: b839ac1e1c5b0ce647322f4cedc6a8a26b250611cf02a052568ff82732872509
Opcode Fuzzy Hash: 7a4823ef9808b37ada3f23253a2a5718a39e00c7bdc2e51d906f976cf9278fd8
Instruction Fuzzy Hash: 732107B5508384EFDB05CF11D9C0B26BBA6FB88318F24C569EB094B346C336DD46CA61

Uniqueness

Uniqueness Score: -1.00%

Function 006ED006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.291645597.00000000006ED000.00000040.00000001.sdmp, Offset: 006ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45b14485200c083e6e4f5e7da07dc4ca3aabfc7fcdabea57ac3579e83add840e
Instruction ID: 1aac10c2cb3b0895a6878172a15c3981d468121b022cd5d8b566636e73ea9854
Opcode Fuzzy Hash: 45b14485200c083e6e4f5e7da07dc4ca3aabfc7fcdabea57ac3579e83add840e
Instruction Fuzzy Hash: BF2162755093C08FCB12CF24D994B55BF71EB46314F28C5DAD8498F6A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 006DD4D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.291589884.00000000006DD000.00000040.00000001.sdmp, Offset: 006DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7feb3e148df0d882d57e988f233f348349f9b6130584996fd795daa038d2b7a
Instruction ID: 9d3d9ff45570fe1882ba7d43be11d04cba418f24bcbfd14601dca60fa424fe0d
Opcode Fuzzy Hash: c7feb3e148df0d882d57e988f233f348349f9b6130584996fd795daa038d2b7a
Instruction Fuzzy Hash: 9811B176804280DFCB11DF10D9C4B56BF72FB98324F2486AAD8050B756C33AD856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 006ED1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.291645597.00000000006ED000.00000040.00000001.sdmp, Offset: 006ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140eabb80c80f3bcf642b4b34e196c70f529ea9b94f5b972a75821fe3ac4ed61
Instruction ID: 6621e2a294ea128e9b8c914c7230332680760b7c4315b2ebdc90d349078e7a80
Opcode Fuzzy Hash: 140eabb80c80f3bcf642b4b34e196c70f529ea9b94f5b972a75821fe3ac4ed61
Instruction Fuzzy Hash: E9118B75904280DFCB11CF10D5C4B55BBB2FB84324F28C6A9DA494B796C33AD94ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 006DD75D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.291589884.00000000006DD000.00000040.00000001.sdmp, Offset: 006DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a115cbbe6d7a405b0244620159870bcc959a84b0e8dbea16705af4fc3cbf27
Instruction ID: 70429060be4bebf54d39039b7e3e51d354102f91270005c7a50b8b24ccb3f1f7
Opcode Fuzzy Hash: 29a115cbbe6d7a405b0244620159870bcc959a84b0e8dbea16705af4fc3cbf27
Instruction Fuzzy Hash: 8801A771909344AEE7106A15DCC4BA6BBA8EF45764F18C4ABED445A346C3789C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 006DD75C, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.291589884.00000000006DD000.00000040.00000001.sdmp, Offset: 006DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 088dbba4d99e431c742933cfa046a59cf9a4de7b81aaed06d4b99aef7234a2e0
Instruction ID: 7c953506089b292e08102212b3d094617d59c52e3511bd16809a560024e8088d
Opcode Fuzzy Hash: 088dbba4d99e431c742933cfa046a59cf9a4de7b81aaed06d4b99aef7234a2e0
Instruction Fuzzy Hash: 82F062718042449EEB248A16DCC4BA2FBA8EB55734F18C59AED485B386C3789C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06984849, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.311516315.0000000006980000.00000040.00000001.sdmp, Offset: 06980000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016fa2c45d6094ee2080be195ae3861e468388cba16f4076f33dc15a7a0d144b
Instruction ID: 27c3170c5c333ad4b72b56562ea3a8ecb6779ff79d3d85e811ec4ccd2959293b
Opcode Fuzzy Hash: 016fa2c45d6094ee2080be195ae3861e468388cba16f4076f33dc15a7a0d144b
Instruction Fuzzy Hash: B0119630C012A98FDB10EFA4C458BFEBBF0AF4A305F14506AD442B7280CB388945CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 06984858, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.311516315.0000000006980000.00000040.00000001.sdmp, Offset: 06980000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb353abf5ea4bc08262bd98e45a6e690e50f360cc03d6c934ac756e3db76260e
Instruction ID: 0bba7b44930bdcaf01d7db56d63b91fcb186d8ca6348006fd9cb3a9ebabccda1
Opcode Fuzzy Hash: eb353abf5ea4bc08262bd98e45a6e690e50f360cc03d6c934ac756e3db76260e
Instruction Fuzzy Hash: F9115730D052998FDB54EFA5C818BEEBAF1AF4E700F14946AD101B7690CB788944CBA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dhcpmon.exe PID: 6008 Parent PID: 2680 dhcpmon.exeCOMMON

Executed Functions

Function 054093E8, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.316545194.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 694c57ed2eb8f0a04844a98ae0f57efb56c7547f81fac264b6c096163109834e
Instruction ID: b9ceee020c26337169750ed82f947f80ad2fd566dd06395034debb11a7d79fb0
Opcode Fuzzy Hash: 694c57ed2eb8f0a04844a98ae0f57efb56c7547f81fac264b6c096163109834e
Instruction Fuzzy Hash: 4F712470A04B058FD764DF2AC444BABB7F1BF88204F108A6ED58AD7B80DB34E845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0540FB20, Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0540FD0A

Memory Dump Source

Source File: 0000000D.00000002.316545194.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b562a76821d4c122e983bc31e8fb1e8d7cd6f7f8dda230d125c4441dd8397f84
Instruction ID: 56c4fef7ac14d99e74a35835efca9fc87288367b603d0bc150271008aeace701
Opcode Fuzzy Hash: b562a76821d4c122e983bc31e8fb1e8d7cd6f7f8dda230d125c4441dd8397f84
Instruction Fuzzy Hash: F06156B1D04348AFCB15CFA9C890ACEBFB1BF49314F2881AEE415AB252D7359846CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0540FB98, Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0540FD0A

Memory Dump Source

Source File: 0000000D.00000002.316545194.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: dc3dfb51d178f095fb8fc246d0eb81493a8a9282e24d0a876f16983e24d38d43
Instruction ID: 8976f3cbd406db769535442ebb77a4f76a38092d03a106bf39e4a1c839b78776
Opcode Fuzzy Hash: dc3dfb51d178f095fb8fc246d0eb81493a8a9282e24d0a876f16983e24d38d43
Instruction Fuzzy Hash: FC511271C04249AFCF15CFA9C884ADEBFB1FF49314F24816AE819AB261D7359985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0540DA04, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0540FD0A

Memory Dump Source

Source File: 0000000D.00000002.316545194.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 602795c582f42977ffadeb164aa013c5241f1068d73d44abbc170427a3211830
Instruction ID: 65d8fb99475b3341019389f21dbb09adca5d61504fc6ad49a74a6f16bb96061e
Opcode Fuzzy Hash: 602795c582f42977ffadeb164aa013c5241f1068d73d44abbc170427a3211830
Instruction Fuzzy Hash: 7151C0B1D10309AFDB14CFA9C884ADEBBB5BF48314F24816AE819AB250D7759985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0540A14C, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0540BCC6,?,?,?,?,?), ref: 0540BD87

Memory Dump Source

Source File: 0000000D.00000002.316545194.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3279d77e70ed96b86e519c6a0a671b69fbe84e2e1c30e0f72d3ee2f329857a6a
Instruction ID: 7829bdcbc048413a3b46de2a3729fd53de8d34e152e3d2ed499795d4eed47266
Opcode Fuzzy Hash: 3279d77e70ed96b86e519c6a0a671b69fbe84e2e1c30e0f72d3ee2f329857a6a
Instruction Fuzzy Hash: BB21F4B59002089FCB10CF99D884BDEFBF4FB48310F14806AE914A3350C378A941CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0540BCF9, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0540BCC6,?,?,?,?,?), ref: 0540BD87

Memory Dump Source

Source File: 0000000D.00000002.316545194.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fb5dbfa838d5b9d3dddca519996cafdbd09629aa1581a18743df4eda85e3f71f
Instruction ID: 6f188637cf4ae1e408ff64980965f306fd2174cf0644361deec54340d67a2e62
Opcode Fuzzy Hash: fb5dbfa838d5b9d3dddca519996cafdbd09629aa1581a18743df4eda85e3f71f
Instruction Fuzzy Hash: 0B2105B59002489FCB10CF99D584AEEFBF4FF48324F14846AE954A3310C338AA45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 05408768, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,054096A9,00000800,00000000,00000000), ref: 054098BA

Memory Dump Source

Source File: 0000000D.00000002.316545194.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: aa40becde9a57a5648d71df4d35b2ae104f17b1c39790274319d50347f195307
Instruction ID: 154dd9abc8e9777d8494f630364a76607ccf6fd0defbb7bbfb2ada4d17a13fef
Opcode Fuzzy Hash: aa40becde9a57a5648d71df4d35b2ae104f17b1c39790274319d50347f195307
Instruction Fuzzy Hash: 0311F2B69042098BDB10CF9AC444BDEBBF4EB48324F14846AE529A7740C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05409849, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,054096A9,00000800,00000000,00000000), ref: 054098BA

Memory Dump Source

Source File: 0000000D.00000002.316545194.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fee72af651ecdaf70215befda1dea120116836b2a64c0b38ebd10beb6e5405cd
Instruction ID: 3daf0b2ce945fb33f0343417da0df5b9569e33d3beccd7c8b201e0cc540a7827
Opcode Fuzzy Hash: fee72af651ecdaf70215befda1dea120116836b2a64c0b38ebd10beb6e5405cd
Instruction Fuzzy Hash: 001103B28002098FDB10CF9AC444BDEFBF4EB88324F14846AD429A7340C379A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05408704, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,054093FB), ref: 0540962E

Memory Dump Source

Source File: 0000000D.00000002.316545194.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7e89e7d5b01ee0729926c6af706f11769006b086c53e77a9ef9549dcc95a38ef
Instruction ID: a976df746b8a6a91416b3676865fcd0de1a28a777477465dca478a1364ddfc30
Opcode Fuzzy Hash: 7e89e7d5b01ee0729926c6af706f11769006b086c53e77a9ef9549dcc95a38ef
Instruction Fuzzy Hash: 5F1104B1D006498FCB10CF9AD444BDFFBF4EB88214F14886AD429A7241C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0540FE38, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0540FE28,?,?,?,?), ref: 0540FE9D

Memory Dump Source

Source File: 0000000D.00000002.316545194.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 8a9ee2e2338ad6d00957e118bb16c354346f2bc57fb03f8f540555ed905499e5
Instruction ID: 91ea2b584f73245d4a2d60e9cb59d3f4d251cb2d041b43e91e50c37a9a22e462
Opcode Fuzzy Hash: 8a9ee2e2338ad6d00957e118bb16c354346f2bc57fb03f8f540555ed905499e5
Instruction Fuzzy Hash: B011E0B58002489FDB10CF99D489BDEBBF8EB48324F10845AE819A7241C378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0540DA3C, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,0540FE28,?,?,?,?), ref: 0540FE9D

Memory Dump Source

Source File: 0000000D.00000002.316545194.0000000005400000.00000040.00000001.sdmp, Offset: 05400000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 1f283340fc1600f186db3b24b8e61908c3626b4a1fa4802512919920d2457697
Instruction ID: 3b0e39a74801e0822c259d5590304335903de9eae78da4d30f12440ca5450fb4
Opcode Fuzzy Hash: 1f283340fc1600f186db3b24b8e61908c3626b4a1fa4802512919920d2457697
Instruction Fuzzy Hash: 6A1106B59002489FDB20CF99D485BDFBBF8FB48324F10846AE915A7341C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report vHLZ6AHJFY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

AV Detection:

E-Banking Fraud:

Stealing of Sensitive Information:

Remote Access Functionality:

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre