Play interactive tour

Edit tour

Windows Analysis Report NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Overview

General Information

Sample Name:	NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Analysis ID:	552509
MD5:	ca0d3ca986e592ec436052f747f833c0
SHA1:	8bdb8ebea5444c42c75c0b30ac8628d06c6cbce0
SHA256:	5e4ccf3d7a2885ab1f1ce83b855ec6f8b771b1731fad4807f8d57b250a5505ad
Tags:	exeNanoCore
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Yara detected AntiVM3

Detected Nanocore Rat

Multi AV Scanner detection for dropped file

Yara detected Nanocore RAT

Initial sample is a PE file and has a suspicious name

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Sigma detected: Suspicius Add Task From User AppData Temp

.NET source code contains potential unpacker

.NET source code contains method to dynamically call methods (often used by packers)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses dynamic DNS services

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

NEW PRICE ENQUIRY FROM PHILLIPINES.exe (PID: 976 cmdline: "C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe" MD5: CA0D3CA986E592EC436052F747F833C0)

NEW PRICE ENQUIRY FROM PHILLIPINES.exe (PID: 6296 cmdline: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe MD5: CA0D3CA986E592EC436052F747F833C0)

schtasks.exe (PID: 4544 cmdline: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5096 cmdline: schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp3019.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

NEW PRICE ENQUIRY FROM PHILLIPINES.exe (PID: 6384 cmdline: "C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe" 0 MD5: CA0D3CA986E592EC436052F747F833C0)

NEW PRICE ENQUIRY FROM PHILLIPINES.exe (PID: 6028 cmdline: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe MD5: CA0D3CA986E592EC436052F747F833C0)

dhcpmon.exe (PID: 4800 cmdline: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0 MD5: CA0D3CA986E592EC436052F747F833C0)

dhcpmon.exe (PID: 5644 cmdline: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe MD5: CA0D3CA986E592EC436052F747F833C0)

dhcpmon.exe (PID: 3832 cmdline: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" MD5: CA0D3CA986E592EC436052F747F833C0)

dhcpmon.exe (PID: 6728 cmdline: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe MD5: CA0D3CA986E592EC436052F747F833C0)

dhcpmon.exe (PID: 6780 cmdline: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe MD5: CA0D3CA986E592EC436052F747F833C0)

dhcpmon.exe (PID: 6992 cmdline: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe MD5: CA0D3CA986E592EC436052F747F833C0)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000005.00000002.405885407.00000000023F1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1831cd:$x1: NanoCore.ClientPluginHost 0x1b5ded:$x1: NanoCore.ClientPluginHost 0x2a897d:$x1: NanoCore.ClientPluginHost 0x18320a:$x2: IClientNetworkHost 0x1b5e2a:$x2: IClientNetworkHost 0x2a89ba:$x2: IClientNetworkHost 0x186d3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b995d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2ac4ed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182f35:$a: NanoCore 0x182f45:$a: NanoCore 0x183179:$a: NanoCore 0x18318d:$a: NanoCore 0x1831cd:$a: NanoCore 0x1b5b55:$a: NanoCore 0x1b5b65:$a: NanoCore 0x1b5d99:$a: NanoCore 0x1b5dad:$a: NanoCore 0x1b5ded:$a: NanoCore 0x2a86e5:$a: NanoCore 0x2a86f5:$a: NanoCore 0x2a8929:$a: NanoCore 0x2a893d:$a: NanoCore 0x2a897d:$a: NanoCore 0x182f94:$b: ClientPlugin 0x183196:$b: ClientPlugin 0x1831d6:$b: ClientPlugin 0x1b5bb4:$b: ClientPlugin 0x1b5db6:$b: ClientPlugin 0x1b5df6:$b: ClientPlugin
00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4356d:$a: NanoCore 0x435c6:$a: NanoCore 0x43603:$a: NanoCore 0x4367c:$a: NanoCore 0x56d27:$a: NanoCore 0x56d3c:$a: NanoCore 0x56d71:$a: NanoCore 0x6fd2b:$a: NanoCore 0x6fd40:$a: NanoCore 0x6fd75:$a: NanoCore 0x435cf:$b: ClientPlugin 0x4360c:$b: ClientPlugin 0x43f0a:$b: ClientPlugin 0x43f17:$b: ClientPlugin 0x56ae3:$b: ClientPlugin 0x56afe:$b: ClientPlugin 0x56b2e:$b: ClientPlugin 0x56d45:$b: ClientPlugin 0x56d7a:$b: ClientPlugin 0x6fae7:$b: ClientPlugin 0x6fb02:$b: ClientPlugin
00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x356d:$a: NanoCore 0x35c6:$a: NanoCore 0x3603:$a: NanoCore 0x367c:$a: NanoCore 0x16d27:$a: NanoCore 0x16d3c:$a: NanoCore 0x16d71:$a: NanoCore 0x2fd2b:$a: NanoCore 0x2fd40:$a: NanoCore 0x2fd75:$a: NanoCore 0x35cf:$b: ClientPlugin 0x360c:$b: ClientPlugin 0x3f0a:$b: ClientPlugin 0x3f17:$b: ClientPlugin 0x16ae3:$b: ClientPlugin 0x16afe:$b: ClientPlugin 0x16b2e:$b: ClientPlugin 0x16d45:$b: ClientPlugin 0x16d7a:$b: ClientPlugin 0x2fae7:$b: ClientPlugin 0x2fb02:$b: ClientPlugin
00000002.00000002.630554205.0000000005910000.00000004.00020000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000002.00000002.630554205.0000000005910000.00000004.00020000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4356d:$a: NanoCore 0x435c6:$a: NanoCore 0x43603:$a: NanoCore 0x4367c:$a: NanoCore 0x56d27:$a: NanoCore 0x56d3c:$a: NanoCore 0x56d71:$a: NanoCore 0x6fd2b:$a: NanoCore 0x6fd40:$a: NanoCore 0x6fd75:$a: NanoCore 0x435cf:$b: ClientPlugin 0x4360c:$b: ClientPlugin 0x43f0a:$b: ClientPlugin 0x43f17:$b: ClientPlugin 0x56ae3:$b: ClientPlugin 0x56afe:$b: ClientPlugin 0x56b2e:$b: ClientPlugin 0x56d45:$b: ClientPlugin 0x56d7a:$b: ClientPlugin 0x6fae7:$b: ClientPlugin 0x6fb02:$b: ClientPlugin
00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4356d:$a: NanoCore 0x435c6:$a: NanoCore 0x43603:$a: NanoCore 0x4367c:$a: NanoCore 0x56d27:$a: NanoCore 0x56d3c:$a: NanoCore 0x56d71:$a: NanoCore 0x6fd2b:$a: NanoCore 0x6fd40:$a: NanoCore 0x6fd75:$a: NanoCore 0x435cf:$b: ClientPlugin 0x4360c:$b: ClientPlugin 0x43f0a:$b: ClientPlugin 0x43f17:$b: ClientPlugin 0x56ae3:$b: ClientPlugin 0x56afe:$b: ClientPlugin 0x56b2e:$b: ClientPlugin 0x56d45:$b: ClientPlugin 0x56d7a:$b: ClientPlugin 0x6fae7:$b: ClientPlugin 0x6fb02:$b: ClientPlugin
00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1831cd:$x1: NanoCore.ClientPluginHost 0x1b5ded:$x1: NanoCore.ClientPluginHost 0x2a897d:$x1: NanoCore.ClientPluginHost 0x18320a:$x2: IClientNetworkHost 0x1b5e2a:$x2: IClientNetworkHost 0x2a89ba:$x2: IClientNetworkHost 0x186d3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b995d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2ac4ed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182f35:$a: NanoCore 0x182f45:$a: NanoCore 0x183179:$a: NanoCore 0x18318d:$a: NanoCore 0x1831cd:$a: NanoCore 0x1b5b55:$a: NanoCore 0x1b5b65:$a: NanoCore 0x1b5d99:$a: NanoCore 0x1b5dad:$a: NanoCore 0x1b5ded:$a: NanoCore 0x2a86e5:$a: NanoCore 0x2a86f5:$a: NanoCore 0x2a8929:$a: NanoCore 0x2a893d:$a: NanoCore 0x2a897d:$a: NanoCore 0x182f94:$b: ClientPlugin 0x183196:$b: ClientPlugin 0x1831d6:$b: ClientPlugin 0x1b5bb4:$b: ClientPlugin 0x1b5db6:$b: ClientPlugin 0x1b5df6:$b: ClientPlugin
00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000008.00000002.415561117.0000000002DE1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x69467:$a: NanoCore 0x694c0:$a: NanoCore 0x694fd:$a: NanoCore 0x69576:$a: NanoCore 0x694c9:$b: ClientPlugin 0x69506:$b: ClientPlugin 0x69e04:$b: ClientPlugin 0x69e11:$b: ClientPlugin 0x5f5e4:$e: KeepAlive 0x69951:$g: LogClientMessage 0x698d1:$i: get_Connected 0x5989d:$j: #=q 0x598cd:$j: #=q 0x59909:$j: #=q 0x59931:$j: #=q 0x59961:$j: #=q 0x59991:$j: #=q 0x599c1:$j: #=q 0x599f1:$j: #=q 0x59a0d:$j: #=q 0x59a3d:$j: #=q
0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x69467:$a: NanoCore 0x694c0:$a: NanoCore 0x694fd:$a: NanoCore 0x69576:$a: NanoCore 0x694c9:$b: ClientPlugin 0x69506:$b: ClientPlugin 0x69e04:$b: ClientPlugin 0x69e11:$b: ClientPlugin 0x5f5e4:$e: KeepAlive 0x69951:$g: LogClientMessage 0x698d1:$i: get_Connected 0x5989d:$j: #=q 0x598cd:$j: #=q 0x59909:$j: #=q 0x59931:$j: #=q 0x59961:$j: #=q 0x59991:$j: #=q 0x599c1:$j: #=q 0x599f1:$j: #=q 0x59a0d:$j: #=q 0x59a3d:$j: #=q
00000000.00000002.375378918.0000000003131000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6959b:$a: NanoCore 0x695f4:$a: NanoCore 0x69631:$a: NanoCore 0x696aa:$a: NanoCore 0x695fd:$b: ClientPlugin 0x6963a:$b: ClientPlugin 0x69f38:$b: ClientPlugin 0x69f45:$b: ClientPlugin 0x5f718:$e: KeepAlive 0x69a85:$g: LogClientMessage 0x69a05:$i: get_Connected 0x599d1:$j: #=q 0x59a01:$j: #=q 0x59a3d:$j: #=q 0x59a65:$j: #=q 0x59a95:$j: #=q 0x59ac5:$j: #=q 0x59af5:$j: #=q 0x59b25:$j: #=q 0x59b41:$j: #=q 0x59b71:$j: #=q
0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1831cd:$x1: NanoCore.ClientPluginHost 0x1b5ded:$x1: NanoCore.ClientPluginHost 0x2a897d:$x1: NanoCore.ClientPluginHost 0x18320a:$x2: IClientNetworkHost 0x1b5e2a:$x2: IClientNetworkHost 0x2a89ba:$x2: IClientNetworkHost 0x186d3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b995d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2ac4ed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182f35:$a: NanoCore 0x182f45:$a: NanoCore 0x183179:$a: NanoCore 0x18318d:$a: NanoCore 0x1831cd:$a: NanoCore 0x1b5b55:$a: NanoCore 0x1b5b65:$a: NanoCore 0x1b5d99:$a: NanoCore 0x1b5dad:$a: NanoCore 0x1b5ded:$a: NanoCore 0x2a86e5:$a: NanoCore 0x2a86f5:$a: NanoCore 0x2a8929:$a: NanoCore 0x2a893d:$a: NanoCore 0x2a897d:$a: NanoCore 0x182f94:$b: ClientPlugin 0x183196:$b: ClientPlugin 0x1831d6:$b: ClientPlugin 0x1b5bb4:$b: ClientPlugin 0x1b5db6:$b: ClientPlugin 0x1b5df6:$b: ClientPlugin
00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1831cd:$x1: NanoCore.ClientPluginHost 0x1b5ded:$x1: NanoCore.ClientPluginHost 0x2a897d:$x1: NanoCore.ClientPluginHost 0x18320a:$x2: IClientNetworkHost 0x1b5e2a:$x2: IClientNetworkHost 0x2a89ba:$x2: IClientNetworkHost 0x186d3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b995d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2ac4ed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182f35:$a: NanoCore 0x182f45:$a: NanoCore 0x183179:$a: NanoCore 0x18318d:$a: NanoCore 0x1831cd:$a: NanoCore 0x1b5b55:$a: NanoCore 0x1b5b65:$a: NanoCore 0x1b5d99:$a: NanoCore 0x1b5dad:$a: NanoCore 0x1b5ded:$a: NanoCore 0x2a86e5:$a: NanoCore 0x2a86f5:$a: NanoCore 0x2a8929:$a: NanoCore 0x2a893d:$a: NanoCore 0x2a897d:$a: NanoCore 0x182f94:$b: ClientPlugin 0x183196:$b: ClientPlugin 0x1831d6:$b: ClientPlugin 0x1b5bb4:$b: ClientPlugin 0x1b5db6:$b: ClientPlugin 0x1b5df6:$b: ClientPlugin
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x111150:$x1: NanoCore.ClientPluginHost 0x11118d:$x2: IClientNetworkHost 0x1145ec:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x11f33a:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x12b208:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x181d33:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x110eef:$a: NanoCore 0x110eff:$a: NanoCore 0x110f5a:$a: NanoCore 0x110f69:$a: NanoCore 0x1110fc:$a: NanoCore 0x111110:$a: NanoCore 0x111150:$a: NanoCore 0x11b9a4:$a: NanoCore 0x11b9b6:$a: NanoCore 0x11b9f2:$a: NanoCore 0x127872:$a: NanoCore 0x127884:$a: NanoCore 0x1278c0:$a: NanoCore 0x17e39d:$a: NanoCore 0x17e3af:$a: NanoCore 0x17e3eb:$a: NanoCore 0x110f13:$b: ClientPlugin 0x110fb3:$b: ClientPlugin 0x111119:$b: ClientPlugin 0x111159:$b: ClientPlugin 0x11b9bf:$b: ClientPlugin
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x18f26:$x1: NanoCore.ClientPluginHost 0x765ba:$x1: NanoCore.ClientPluginHost 0x96be1:$x1: NanoCore.ClientPluginHost 0xb3c31:$x1: NanoCore.ClientPluginHost 0x18f63:$x2: IClientNetworkHost 0x765d4:$x2: IClientNetworkHost 0x96bfb:$x2: IClientNetworkHost 0xb3c5e:$x2: IClientNetworkHost 0x1ca54:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x27ada:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x18bf3:$a: NanoCore 0x18c03:$a: NanoCore 0x18cc2:$a: NanoCore 0x18cd1:$a: NanoCore 0x18ed2:$a: NanoCore 0x18ee6:$a: NanoCore 0x18f26:$a: NanoCore 0x24144:$a: NanoCore 0x24156:$a: NanoCore 0x24192:$a: NanoCore 0x473df:$a: NanoCore 0x6b761:$a: NanoCore 0x6b7bc:$a: NanoCore 0x6b82f:$a: NanoCore 0x76524:$a: NanoCore 0x7657d:$a: NanoCore 0x765ba:$a: NanoCore 0x76633:$a: NanoCore 0x76ed7:$a: NanoCore 0x76f2a:$a: NanoCore 0x76f63:$a: NanoCore
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x12ed85:$x1: NanoCore.ClientPluginHost 0x12edc2:$x2: IClientNetworkHost 0x132221:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x13cf6f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x148e3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x19f968:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x12eb24:$a: NanoCore 0x12eb34:$a: NanoCore 0x12eb8f:$a: NanoCore 0x12eb9e:$a: NanoCore 0x12ed31:$a: NanoCore 0x12ed45:$a: NanoCore 0x12ed85:$a: NanoCore 0x1395d9:$a: NanoCore 0x1395eb:$a: NanoCore 0x139627:$a: NanoCore 0x1454a7:$a: NanoCore 0x1454b9:$a: NanoCore 0x1454f5:$a: NanoCore 0x19bfd2:$a: NanoCore 0x19bfe4:$a: NanoCore 0x19c020:$a: NanoCore 0x12eb48:$b: ClientPlugin 0x12ebe8:$b: ClientPlugin 0x12ed4e:$b: ClientPlugin 0x12ed8e:$b: ClientPlugin 0x1395f4:$b: ClientPlugin
Process Memory Space: dhcpmon.exe PID: 4800	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x13732e:$x1: NanoCore.ClientPluginHost 0x13736b:$x2: IClientNetworkHost 0x13a7ca:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x145518:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1513e6:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1a7f11:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 4800	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: dhcpmon.exe PID: 4800	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 4800	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1370cd:$a: NanoCore 0x1370dd:$a: NanoCore 0x137138:$a: NanoCore 0x137147:$a: NanoCore 0x1372da:$a: NanoCore 0x1372ee:$a: NanoCore 0x13732e:$a: NanoCore 0x141b82:$a: NanoCore 0x141b94:$a: NanoCore 0x141bd0:$a: NanoCore 0x14da50:$a: NanoCore 0x14da62:$a: NanoCore 0x14da9e:$a: NanoCore 0x1a457b:$a: NanoCore 0x1a458d:$a: NanoCore 0x1a45c9:$a: NanoCore 0x1370f1:$b: ClientPlugin 0x137191:$b: ClientPlugin 0x1372f7:$b: ClientPlugin 0x137337:$b: ClientPlugin 0x141b9d:$b: ClientPlugin
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x112a6:$x1: NanoCore.ClientPluginHost 0x38b13:$x1: NanoCore.ClientPluginHost 0x646f1:$x1: NanoCore.ClientPluginHost 0x112e3:$x2: IClientNetworkHost 0x38b2d:$x2: IClientNetworkHost 0x6470b:$x2: IClientNetworkHost 0x14dd4:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1fe5a:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10f73:$a: NanoCore 0x10f83:$a: NanoCore 0x11042:$a: NanoCore 0x11051:$a: NanoCore 0x11252:$a: NanoCore 0x11266:$a: NanoCore 0x112a6:$a: NanoCore 0x1c4c4:$a: NanoCore 0x1c4d6:$a: NanoCore 0x1c512:$a: NanoCore 0x38a7d:$a: NanoCore 0x38ad6:$a: NanoCore 0x38b13:$a: NanoCore 0x38b8c:$a: NanoCore 0x39445:$a: NanoCore 0x39498:$a: NanoCore 0x394d1:$a: NanoCore 0x39544:$a: NanoCore 0x40b16:$a: NanoCore 0x40b29:$a: NanoCore 0x40b5b:$a: NanoCore
Process Memory Space: dhcpmon.exe PID: 3832	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd6a7c:$x1: NanoCore.ClientPluginHost 0xd6ab9:$x2: IClientNetworkHost 0xd9f18:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xe4c66:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xf0b34:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x14765f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 3832	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: dhcpmon.exe PID: 3832	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 3832	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xd681b:$a: NanoCore 0xd682b:$a: NanoCore 0xd6886:$a: NanoCore 0xd6895:$a: NanoCore 0xd6a28:$a: NanoCore 0xd6a3c:$a: NanoCore 0xd6a7c:$a: NanoCore 0xe12d0:$a: NanoCore 0xe12e2:$a: NanoCore 0xe131e:$a: NanoCore 0xed19e:$a: NanoCore 0xed1b0:$a: NanoCore 0xed1ec:$a: NanoCore 0x143cc9:$a: NanoCore 0x143cdb:$a: NanoCore 0x143d17:$a: NanoCore 0xd683f:$b: ClientPlugin 0xd68df:$b: ClientPlugin 0xd6a45:$b: ClientPlugin 0xd6a85:$b: ClientPlugin 0xe12eb:$b: ClientPlugin
Process Memory Space: dhcpmon.exe PID: 5644	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1c1d1:$x1: NanoCore.ClientPluginHost 0x34adc:$x1: NanoCore.ClientPluginHost 0x5e19b:$x1: NanoCore.ClientPluginHost 0x1c20e:$x2: IClientNetworkHost 0x34af6:$x2: IClientNetworkHost 0x5e1b5:$x2: IClientNetworkHost 0x1fcff:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2ad85:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 5644	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 5644	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1be9e:$a: NanoCore 0x1beae:$a: NanoCore 0x1bf6d:$a: NanoCore 0x1bf7c:$a: NanoCore 0x1c17d:$a: NanoCore 0x1c191:$a: NanoCore 0x1c1d1:$a: NanoCore 0x273ef:$a: NanoCore 0x27401:$a: NanoCore 0x2743d:$a: NanoCore 0x34a46:$a: NanoCore 0x34a9f:$a: NanoCore 0x34adc:$a: NanoCore 0x34b55:$a: NanoCore 0x3540e:$a: NanoCore 0x35461:$a: NanoCore 0x3549a:$a: NanoCore 0x3550d:$a: NanoCore 0x3cadf:$a: NanoCore 0x3caf2:$a: NanoCore 0x3cb24:$a: NanoCore
Process Memory Space: dhcpmon.exe PID: 6992	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x19939:$x1: NanoCore.ClientPluginHost 0x35bc2:$x1: NanoCore.ClientPluginHost 0x5f7b1:$x1: NanoCore.ClientPluginHost 0x19976:$x2: IClientNetworkHost 0x35bdc:$x2: IClientNetworkHost 0x5f7cb:$x2: IClientNetworkHost 0x1d467:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x284ed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 6992	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 6992	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x19606:$a: NanoCore 0x19616:$a: NanoCore 0x196d5:$a: NanoCore 0x196e4:$a: NanoCore 0x198e5:$a: NanoCore 0x198f9:$a: NanoCore 0x19939:$a: NanoCore 0x24b57:$a: NanoCore 0x24b69:$a: NanoCore 0x24ba5:$a: NanoCore 0x35b2c:$a: NanoCore 0x35b85:$a: NanoCore 0x35bc2:$a: NanoCore 0x35c3b:$a: NanoCore 0x364f4:$a: NanoCore 0x36547:$a: NanoCore 0x36580:$a: NanoCore 0x365f3:$a: NanoCore 0x3dbc5:$a: NanoCore 0x3dbd8:$a: NanoCore 0x3dc0a:$a: NanoCore
Click to see the 119 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.2f997bc.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.2f997bc.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
8.2.dhcpmon.exe.2e38774.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
11.2.dhcpmon.exe.399ec60.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.2.dhcpmon.exe.399ec60.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
11.2.dhcpmon.exe.399ec60.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.dhcpmon.exe.399ec60.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.2.dhcpmon.exe.3e8b78e.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5e7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d614:$x2: IClientNetworkHost
18.2.dhcpmon.exe.3e8b78e.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5e7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6c2:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d601:$s5: IClientLoggingHost
18.2.dhcpmon.exe.3e8b78e.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.2.dhcpmon.exe.3e8b78e.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d59d:$a: NanoCore 0x2d5b2:$a: NanoCore 0x2d5e7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d359:$b: ClientPlugin 0x2d374:$b: ClientPlugin
18.0.dhcpmon.exe.400000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
18.0.dhcpmon.exe.400000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
18.0.dhcpmon.exe.400000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.0.dhcpmon.exe.400000.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24188:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241b5:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24188:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25263:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241a2:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.315dc78.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3188810.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
18.2.dhcpmon.exe.3e905c4.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
18.2.dhcpmon.exe.3e905c4.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
18.2.dhcpmon.exe.3e905c4.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.2.dhcpmon.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3186a78.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3186a78.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
18.0.dhcpmon.exe.400000.10.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
18.0.dhcpmon.exe.400000.10.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
18.0.dhcpmon.exe.400000.10.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.0.dhcpmon.exe.400000.10.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24188:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241b5:$x2: IClientNetworkHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24188:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25263:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241a2:$s5: IClientLoggingHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.dhcpmon.exe.400000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.dhcpmon.exe.400000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.dhcpmon.exe.400000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.dhcpmon.exe.400000.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
11.2.dhcpmon.exe.396c040.7.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.2.dhcpmon.exe.396c040.7.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
11.2.dhcpmon.exe.396c040.7.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.dhcpmon.exe.396c040.7.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
8.2.dhcpmon.exe.3f5c040.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.3f5c040.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
8.2.dhcpmon.exe.3f5c040.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.3f5c040.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
12.2.dhcpmon.exe.3b705c4.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
12.2.dhcpmon.exe.3b705c4.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
12.2.dhcpmon.exe.3b705c4.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.3b705c4.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287b1:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287de:$x2: IClientNetworkHost
12.2.dhcpmon.exe.3b705c4.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287b1:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2988c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287cb:$s5: IClientLoggingHost
12.2.dhcpmon.exe.3b705c4.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.2b89688.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
12.2.dhcpmon.exe.2b89688.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287b1:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287de:$x2: IClientNetworkHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287b1:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2988c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287cb:$s5: IClientLoggingHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x102d1d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x102d5a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x10688d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x102a85:$a: NanoCore 0x102a95:$a: NanoCore 0x102cc9:$a: NanoCore 0x102cdd:$a: NanoCore 0x102d1d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x102ae4:$b: ClientPlugin 0x102ce6:$b: ClientPlugin 0x102d26:$b: ClientPlugin 0x1007b:$c: ProjectData 0xa71ff:$c: ProjectData 0x102c0b:$c: ProjectData 0x10a82:$d: DESCrypto 0x103612:$d: DESCrypto
18.0.dhcpmon.exe.400000.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
18.0.dhcpmon.exe.400000.12.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
18.0.dhcpmon.exe.400000.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.0.dhcpmon.exe.400000.12.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
18.0.dhcpmon.exe.400000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
18.0.dhcpmon.exe.400000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
18.0.dhcpmon.exe.400000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.0.dhcpmon.exe.400000.8.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
18.2.dhcpmon.exe.3e905c4.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287b1:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287de:$x2: IClientNetworkHost
18.2.dhcpmon.exe.3e905c4.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287b1:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2988c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287cb:$s5: IClientLoggingHost
18.2.dhcpmon.exe.3e905c4.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5e7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d614:$x2: IClientNetworkHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5e7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6c2:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d601:$s5: IClientLoggingHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d59d:$a: NanoCore 0x2d5b2:$a: NanoCore 0x2d5e7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d359:$b: ClientPlugin 0x2d374:$b: ClientPlugin
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.5910000.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.5910000.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287b1:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287de:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287b1:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2988c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287cb:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.2e0dbdc.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
12.2.dhcpmon.exe.3b6b78e.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5e7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d614:$x2: IClientNetworkHost
12.2.dhcpmon.exe.3b6b78e.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5e7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6c2:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d601:$s5: IClientLoggingHost
12.2.dhcpmon.exe.3b6b78e.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.3b6b78e.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d59d:$a: NanoCore 0x2d5b2:$a: NanoCore 0x2d5e7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d359:$b: ClientPlugin 0x2d374:$b: ClientPlugin
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42dad:$x1: NanoCore.ClientPluginHost 0x13593d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42dea:$x2: IClientNetworkHost 0x13597a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4691d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1394ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42b15:$a: NanoCore 0x42b25:$a: NanoCore 0x42d59:$a: NanoCore 0x42d6d:$a: NanoCore 0x42dad:$a: NanoCore 0x1356a5:$a: NanoCore 0x1356b5:$a: NanoCore 0x1358e9:$a: NanoCore 0x1358fd:$a: NanoCore 0x13593d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42b74:$b: ClientPlugin 0x42d76:$b: ClientPlugin 0x42db6:$b: ClientPlugin
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.241dc78.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.0.dhcpmon.exe.400000.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.dhcpmon.exe.400000.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.dhcpmon.exe.400000.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.dhcpmon.exe.400000.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x102d1d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x102d5a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x10688d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
18.0.dhcpmon.exe.400000.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
18.0.dhcpmon.exe.400000.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
18.0.dhcpmon.exe.400000.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.0.dhcpmon.exe.400000.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x102a85:$a: NanoCore 0x102a95:$a: NanoCore 0x102cc9:$a: NanoCore 0x102cdd:$a: NanoCore 0x102d1d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x102ae4:$b: ClientPlugin 0x102ce6:$b: ClientPlugin 0x102d26:$b: ClientPlugin 0x1007b:$c: ProjectData 0xa71ff:$c: ProjectData 0x102c0b:$c: ProjectData 0x10a82:$d: DESCrypto 0x103612:$d: DESCrypto
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
18.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
18.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
18.2.dhcpmon.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.2.dhcpmon.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.2448810.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
8.2.dhcpmon.exe.3f8ec60.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x102d1d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x102d5a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x10688d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.3f8ec60.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.3f8ec60.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x102a85:$a: NanoCore 0x102a95:$a: NanoCore 0x102cc9:$a: NanoCore 0x102cdd:$a: NanoCore 0x102d1d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x102ae4:$b: ClientPlugin 0x102ce6:$b: ClientPlugin 0x102d26:$b: ClientPlugin 0x1007b:$c: ProjectData 0xa71ff:$c: ProjectData 0x102c0b:$c: ProjectData 0x10a82:$d: DESCrypto 0x103612:$d: DESCrypto
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
8.2.dhcpmon.exe.3f8ec60.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.3f8ec60.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
8.2.dhcpmon.exe.3f8ec60.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.3f8ec60.5.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
11.2.dhcpmon.exe.2848774.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
12.0.dhcpmon.exe.400000.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.dhcpmon.exe.400000.12.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.dhcpmon.exe.400000.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.dhcpmon.exe.400000.12.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
8.2.dhcpmon.exe.3f5c040.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42dad:$x1: NanoCore.ClientPluginHost 0x13593d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42dea:$x2: IClientNetworkHost 0x13597a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4691d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1394ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.3f5c040.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.3f5c040.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42b15:$a: NanoCore 0x42b25:$a: NanoCore 0x42d59:$a: NanoCore 0x42d6d:$a: NanoCore 0x42dad:$a: NanoCore 0x1356a5:$a: NanoCore 0x1356b5:$a: NanoCore 0x1358e9:$a: NanoCore 0x1358fd:$a: NanoCore 0x13593d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42b74:$b: ClientPlugin 0x42d76:$b: ClientPlugin 0x42db6:$b: ClientPlugin
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42dad:$x1: NanoCore.ClientPluginHost 0x13593d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42dea:$x2: IClientNetworkHost 0x13597a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4691d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1394ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42b15:$a: NanoCore 0x42b25:$a: NanoCore 0x42d59:$a: NanoCore 0x42d6d:$a: NanoCore 0x42dad:$a: NanoCore 0x1356a5:$a: NanoCore 0x1356b5:$a: NanoCore 0x1358e9:$a: NanoCore 0x1358fd:$a: NanoCore 0x13593d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42b74:$b: ClientPlugin 0x42d76:$b: ClientPlugin 0x42db6:$b: ClientPlugin
11.2.dhcpmon.exe.396c040.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42dad:$x1: NanoCore.ClientPluginHost 0x13593d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42dea:$x2: IClientNetworkHost 0x13597a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4691d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1394ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.2.dhcpmon.exe.396c040.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.dhcpmon.exe.396c040.7.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42b15:$a: NanoCore 0x42b25:$a: NanoCore 0x42d59:$a: NanoCore 0x42d6d:$a: NanoCore 0x42dad:$a: NanoCore 0x1356a5:$a: NanoCore 0x1356b5:$a: NanoCore 0x1358e9:$a: NanoCore 0x1358fd:$a: NanoCore 0x13593d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42b74:$b: ClientPlugin 0x42d76:$b: ClientPlugin 0x42db6:$b: ClientPlugin
11.2.dhcpmon.exe.281dbdc.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.dhcpmon.exe.3b74bed.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24188:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241b5:$x2: IClientNetworkHost
12.2.dhcpmon.exe.3b74bed.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24188:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25263:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241a2:$s5: IClientLoggingHost
12.2.dhcpmon.exe.3b74bed.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.2.dhcpmon.exe.2ea9688.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
18.2.dhcpmon.exe.2ea9688.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5e7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d614:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5e7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6c2:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d601:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d59d:$a: NanoCore 0x2d5b2:$a: NanoCore 0x2d5e7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d359:$b: ClientPlugin 0x2d374:$b: ClientPlugin
18.2.dhcpmon.exe.3e94bed.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24188:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241b5:$x2: IClientNetworkHost
18.2.dhcpmon.exe.3e94bed.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24188:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25263:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241a2:$s5: IClientLoggingHost
18.2.dhcpmon.exe.3e94bed.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.dhcpmon.exe.400000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.dhcpmon.exe.400000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.dhcpmon.exe.400000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.dhcpmon.exe.400000.8.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.0.dhcpmon.exe.400000.10.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.dhcpmon.exe.400000.10.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.dhcpmon.exe.400000.10.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.dhcpmon.exe.400000.10.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
11.2.dhcpmon.exe.399ec60.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x102d1d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x102d5a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x10688d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.2.dhcpmon.exe.399ec60.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.dhcpmon.exe.399ec60.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x102a85:$a: NanoCore 0x102a95:$a: NanoCore 0x102cc9:$a: NanoCore 0x102cdd:$a: NanoCore 0x102d1d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x102ae4:$b: ClientPlugin 0x102ce6:$b: ClientPlugin 0x102d26:$b: ClientPlugin 0x1007b:$c: ProjectData 0xa71ff:$c: ProjectData 0x102c0b:$c: ProjectData 0x10a82:$d: DESCrypto 0x103612:$d: DESCrypto
8.2.dhcpmon.exe.3de9930.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x18289d:$x1: NanoCore.ClientPluginHost 0x1b54bd:$x1: NanoCore.ClientPluginHost 0x2a804d:$x1: NanoCore.ClientPluginHost 0x1828da:$x2: IClientNetworkHost 0x1b54fa:$x2: IClientNetworkHost 0x2a808a:$x2: IClientNetworkHost 0x18640d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b902d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2abbbd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.3de9930.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.3de9930.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182605:$a: NanoCore 0x182615:$a: NanoCore 0x182849:$a: NanoCore 0x18285d:$a: NanoCore 0x18289d:$a: NanoCore 0x1b5225:$a: NanoCore 0x1b5235:$a: NanoCore 0x1b5469:$a: NanoCore 0x1b547d:$a: NanoCore 0x1b54bd:$a: NanoCore 0x2a7db5:$a: NanoCore 0x2a7dc5:$a: NanoCore 0x2a7ff9:$a: NanoCore 0x2a800d:$a: NanoCore 0x2a804d:$a: NanoCore 0x182664:$b: ClientPlugin 0x182866:$b: ClientPlugin 0x1828a6:$b: ClientPlugin 0x1b5284:$b: ClientPlugin 0x1b5486:$b: ClientPlugin 0x1b54c6:$b: ClientPlugin
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x18289d:$x1: NanoCore.ClientPluginHost 0x1b54bd:$x1: NanoCore.ClientPluginHost 0x2a804d:$x1: NanoCore.ClientPluginHost 0x1828da:$x2: IClientNetworkHost 0x1b54fa:$x2: IClientNetworkHost 0x2a808a:$x2: IClientNetworkHost 0x18640d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b902d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2abbbd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182605:$a: NanoCore 0x182615:$a: NanoCore 0x182849:$a: NanoCore 0x18285d:$a: NanoCore 0x18289d:$a: NanoCore 0x1b5225:$a: NanoCore 0x1b5235:$a: NanoCore 0x1b5469:$a: NanoCore 0x1b547d:$a: NanoCore 0x1b54bd:$a: NanoCore 0x2a7db5:$a: NanoCore 0x2a7dc5:$a: NanoCore 0x2a7ff9:$a: NanoCore 0x2a800d:$a: NanoCore 0x2a804d:$a: NanoCore 0x182664:$b: ClientPlugin 0x182866:$b: ClientPlugin 0x1828a6:$b: ClientPlugin 0x1b5284:$b: ClientPlugin 0x1b5486:$b: ClientPlugin 0x1b54c6:$b: ClientPlugin
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x18289d:$x1: NanoCore.ClientPluginHost 0x1b54bd:$x1: NanoCore.ClientPluginHost 0x2a804d:$x1: NanoCore.ClientPluginHost 0x1828da:$x2: IClientNetworkHost 0x1b54fa:$x2: IClientNetworkHost 0x2a808a:$x2: IClientNetworkHost 0x18640d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b902d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2abbbd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182605:$a: NanoCore 0x182615:$a: NanoCore 0x182849:$a: NanoCore 0x18285d:$a: NanoCore 0x18289d:$a: NanoCore 0x1b5225:$a: NanoCore 0x1b5235:$a: NanoCore 0x1b5469:$a: NanoCore 0x1b547d:$a: NanoCore 0x1b54bd:$a: NanoCore 0x2a7db5:$a: NanoCore 0x2a7dc5:$a: NanoCore 0x2a7ff9:$a: NanoCore 0x2a800d:$a: NanoCore 0x2a804d:$a: NanoCore 0x182664:$b: ClientPlugin 0x182866:$b: ClientPlugin 0x1828a6:$b: ClientPlugin 0x1b5284:$b: ClientPlugin 0x1b5486:$b: ClientPlugin 0x1b54c6:$b: ClientPlugin
11.2.dhcpmon.exe.37f9930.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x18289d:$x1: NanoCore.ClientPluginHost 0x1b54bd:$x1: NanoCore.ClientPluginHost 0x2a804d:$x1: NanoCore.ClientPluginHost 0x1828da:$x2: IClientNetworkHost 0x1b54fa:$x2: IClientNetworkHost 0x2a808a:$x2: IClientNetworkHost 0x18640d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b902d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2abbbd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.2.dhcpmon.exe.37f9930.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.dhcpmon.exe.37f9930.8.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182605:$a: NanoCore 0x182615:$a: NanoCore 0x182849:$a: NanoCore 0x18285d:$a: NanoCore 0x18289d:$a: NanoCore 0x1b5225:$a: NanoCore 0x1b5235:$a: NanoCore 0x1b5469:$a: NanoCore 0x1b547d:$a: NanoCore 0x1b54bd:$a: NanoCore 0x2a7db5:$a: NanoCore 0x2a7dc5:$a: NanoCore 0x2a7ff9:$a: NanoCore 0x2a800d:$a: NanoCore 0x2a804d:$a: NanoCore 0x182664:$b: ClientPlugin 0x182866:$b: ClientPlugin 0x1828a6:$b: ClientPlugin 0x1b5284:$b: ClientPlugin 0x1b5486:$b: ClientPlugin 0x1b54c6:$b: ClientPlugin
Click to see the 238 entries

Sigma Overview

AV Detection:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe, ProcessId: 6296, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud:

Sigma detected: NanoCore

Show sources

Source: File created

System Summary:

Sigma detected: Suspicius Add Task From User AppData Temp

Show sources

Source: Process started

Author: frack113: Data: Command: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp, CommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe, ParentImage: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe, ParentProcessId: 6296, ProcessCommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp, ProcessId: 4544

Stealing of Sensitive Information:

Sigma detected: NanoCore

Show sources

Source: File created

Remote Access Functionality:

Sigma detected: NanoCore

Show sources

Source: File created

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Virustotal: Detection: 33%	Perma Link
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Metadefender: Detection: 28%	Perma Link
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	ReversingLabs: Detection: 48%

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Metadefender: Detection: 28%			Perma Link
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	ReversingLabs: Detection: 48%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b74bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e94bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR

Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 18.0.dhcpmon.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.2.dhcpmon.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack	Avira: Label: TR/NanoCore.fadte
Source: 18.0.dhcpmon.exe.400000.10.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.dhcpmon.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 18.0.dhcpmon.exe.400000.12.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 18.0.dhcpmon.exe.400000.8.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 18.0.dhcpmon.exe.400000.6.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.dhcpmon.exe.400000.6.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 18.2.dhcpmon.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.dhcpmon.exe.400000.12.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.dhcpmon.exe.400000.10.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.dhcpmon.exe.400000.8.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: PermissionSetAttribu.pdb source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp

Networking:

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: kashbilly.ddns.net

Source: global traffic

TCP traffic: 192.168.2.6:49757 -> 197.211.59.104:6060

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://ati.amd.com/developer/compressonator.html
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://developer.nvidia.com/object/dds_thumbnail_viewer.html
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://developer.nvidia.com/object/photoshop_dds_plugins.html
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	String found in binary or memory: http://developer.nvidia.com/object/photoshop_dds_plugins.htmlyhttp://developer.nvidia.com/object/dds
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, dhcpmon.exe, 0000000B.00000002.440433881.0000000006CA0000.00000004.00020000.sdmp	String found in binary or memory: http://igaeditor.sourceforge.net/
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://igaeditor.sourceforge.net/latest.txt
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	String found in binary or memory: http://igaeditor.sourceforge.net/ohttp://www.totalbf2142.com/forums/showthread.php?t=5342Whttp://iga
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://igaeditor.sourceforge.net/wiki/
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.379123716.0000000007C20000.00000004.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.412733612.0000000006B30000.00000004.00020000.sdmp, dhcpmon.exe, 00000008.00000002.418987180.0000000007370000.00000004.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.440433881.0000000006CA0000.00000004.00020000.sdmp	String found in binary or memory: http://micolous.id.au/
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://micolous.id.au/projects/bf21
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.379123716.0000000007C20000.00000004.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.412733612.0000000006B30000.00000004.00020000.sdmp, dhcpmon.exe, 00000008.00000002.418987180.0000000007370000.00000004.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.440433881.0000000006CA0000.00000004.00020000.sdmp	String found in binary or memory: http://micolous.id.au/projects/bf2142/
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	String found in binary or memory: http://micolous.id.au/projects/bf2142/.
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://registry.gimp.org/plugin?id=4816
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	String found in binary or memory: http://www.gimp.org/windows/
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	String found in binary or memory: http://www.pcgamingboards.com/smf/index.php?topic=129.msg279#msg279
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://www.radgametools.com/bnkdown.htm
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://www.totalbf2142.com/forums/showthread.php?t=5342
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: https://sourceforge.net/project/showfiles.php?group_id=181663
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	String found in binary or memory: https://sourceforge.net/project/showfiles.php?group_id=181663Mhttp://igaeditor.sourceforge.net/wiki/
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: https://sourceforge.net/svn/?group_id=181663

Source: unknown

DNS traffic detected: queries for: kashbilly.ddns.net

Source: dhcpmon.exe, 00000008.00000002.414092694.0000000001098000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b74bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e94bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.2f997bc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.3e905c4.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3186a78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.dhcpmon.exe.3b705c4.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.3b705c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.2b89688.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.2.dhcpmon.exe.3e905c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.5910000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.dhcpmon.exe.3b74bed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.2ea9688.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.2.dhcpmon.exe.3e94bed.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.630554205.0000000005910000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.2f997bc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.2f997bc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.2.dhcpmon.exe.3e905c4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.3e905c4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3186a78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3186a78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.dhcpmon.exe.3b705c4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.3b705c4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.dhcpmon.exe.3b705c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.3b705c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.dhcpmon.exe.2b89688.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.2b89688.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.2.dhcpmon.exe.3e905c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.3e905c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.5910000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.5910000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.dhcpmon.exe.3b74bed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.3b74bed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.2.dhcpmon.exe.2ea9688.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.2ea9688.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.2.dhcpmon.exe.3e94bed.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.3e94bed.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.630554205.0000000005910000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.630554205.0000000005910000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_0310C3F4	0_2_0310C3F4
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_0310E9F8	0_2_0310E9F8
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_0310E9E8	0_2_0310E9E8
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_076EBFE8	0_2_076EBFE8
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_076E3568	0_2_076E3568
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_076E35C0	0_2_076E35C0
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_076E35B0	0_2_076E35B0
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_0161E471	2_2_0161E471
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_0161E480	2_2_0161E480
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_0161BBD4	2_2_0161BBD4
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_05796550	2_2_05796550
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_05793E30	2_2_05793E30
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_0579C6F0	2_2_0579C6F0
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_0579D308	2_2_0579D308
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_05794A50	2_2_05794A50
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_0579D640	2_2_0579D640
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_05794B08	2_2_05794B08
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_0579D3C6	2_2_0579D3C6
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_06BE0040	2_2_06BE0040
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_0492C3F4	5_2_0492C3F4
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_0492E9F2	5_2_0492E9F2
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_0492E9F8	5_2_0492E9F8
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_066BBFE8	5_2_066BBFE8
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_066B3569	5_2_066B3569
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_066B35C0	5_2_066B35C0
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_066B35B0	5_2_066B35B0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_0133C3F4	8_2_0133C3F4
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_0133E9F4	8_2_0133E9F4
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_0133E9F8	8_2_0133E9F8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_053E7F98	8_2_053E7F98
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_053E7F89	8_2_053E7F89
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_053E6988	8_2_053E6988
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_0753BFE8	8_2_0753BFE8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_07533569	8_2_07533569
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_075335C0	8_2_075335C0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_075335B0	8_2_075335B0
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 9_2_0123E471	9_2_0123E471
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 9_2_0123E480	9_2_0123E480
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 9_2_0123BBD4	9_2_0123BBD4

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374253790.0000000000E24000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePermissionSetAttribu.exeH vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUI.dllF vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368688896.0000000000DF4000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePermissionSetAttribu.exeH vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.630982055.0000000006860000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.404702459.00000000001D4000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePermissionSetAttribu.exeH vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUI.dllF vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.420068237.0000000000BF4000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePermissionSetAttribu.exeH vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.420894807.000000000125A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dhcpmon.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dhcpmon.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Virustotal: Detection: 33%
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Metadefender: Detection: 28%
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	ReversingLabs: Detection: 48%

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

File read: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Jump to behavior

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe "C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe"
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe "C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe" 0
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp3019.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe"
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp3019.tmp	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to behavior

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NEW PRICE ENQUIRY FROM PHILLIPINES.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

File created: C:\Users\user\AppData\Local\Temp\tmp1E56.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@22/8@7/1

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp

Binary or memory string: INSERT INTO [content] ([active], [activate], [expire], [dayparts], [contentType], [descriptor], [size], [viewcount], [viewlimit], [displayafter], [props], [data]) VALUES (@active, @activate, @expire, @dayparts, @contentType, @descriptor, @size, @viewcount, @viewlimit, @displayafter, @props, @data); SELECT last_insert_rowid() AS contentId;

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{51e297f7-7758-4d32-86af-0aafa20a3f56}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4712:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5396:120:WilError_01

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, mee/Keg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d60000.0.unpack, mee/Keg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d60000.0.unpack, mee/Keg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: dhcpmon.exe.2.dr, mee/Keg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.1.unpack, mee/Keg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.3.unpack, mee/Keg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.7.unpack, mee/Keg.cs	Cryptographic APIs: 'CreateDecryptor'

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d60000.0.unpack, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d60000.0.unpack, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: dhcpmon.exe.2.dr, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.1.unpack, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.3.unpack, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.7.unpack, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.11.unpack, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.1.unpack, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d60000.0.unpack, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d60000.0.unpack, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: dhcpmon.exe.2.dr, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.1.unpack, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.3.unpack, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.7.unpack, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.11.unpack, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.1.unpack, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_076E61E9 push ebx; iretd	0_2_076E61EA
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_066B8E8B push es; ret	5_2_066B8E8C
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_066B8B7F push es; iretd	5_2_066B8B84
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_066B61E9 push ebx; iretd	5_2_066B61EA
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_075361E9 push ebx; iretd	8_2_075361EA

Source: initial sample	Static PE information: section name: .text entropy: 7.78570516551
Source: initial sample	Static PE information: section name: .text entropy: 7.78570516551

Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

File opened: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 8.2.dhcpmon.exe.2e38774.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.315dc78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3188810.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.2e0dbdc.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.241dc78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.2448810.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.2848774.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.281dbdc.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.405885407.00000000023F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.415561117.0000000002DE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.375378918.0000000003131000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.375378918.0000000003131000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.405885407.00000000023F1000.00000004.00000001.sdmp, dhcpmon.exe, 00000008.00000002.415561117.0000000002DE1000.00000004.00000001.sdmp, dhcpmon.exe, 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.375378918.0000000003131000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.405885407.00000000023F1000.00000004.00000001.sdmp, dhcpmon.exe, 00000008.00000002.415561117.0000000002DE1000.00000004.00000001.sdmp, dhcpmon.exe, 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe TID: 772	Thread sleep time: -39926s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe TID: 6224	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe TID: 5888	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe TID: 6420	Thread sleep time: -38463s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe TID: 5104	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4400	Thread sleep time: -35164s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5964	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe TID: 6636	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5024	Thread sleep time: -33769s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5596	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 6704	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 6824	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Window / User API: threadDelayed 6516	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Window / User API: threadDelayed 2954	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Window / User API: foregroundWindowGot 874	Jump to behavior

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 39926	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 38463	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 35164	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 33769	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: dhcpmon.exe, 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: dhcpmon.exe, 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.627007908.00000000012E5000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: dhcpmon.exe, 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp3019.tmp	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to behavior

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628991392.00000000031C7000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629899402.0000000003722000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629391684.00000000032A7000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629737178.0000000003592000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629584039.00000000033FD000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.630799975.00000000065EB000.00000004.00000010.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629242696.0000000003259000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.631357745.00000000070ED000.00000004.00000010.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.631186845.0000000006BBC000.00000004.00000010.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.630964365.000000000685D000.00000004.00000010.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629433411.00000000032B4000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628490640.0000000001C40000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628490640.0000000001C40000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628490640.0000000001C40000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628490640.0000000001C40000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b74bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e94bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b74bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e94bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Process Injection12	Masquerading2	Input Capture21	Security Software Discovery21	Remote Services	Input Capture21	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion21	Security Account Manager	Virtualization/Sandbox Evasion21	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	System Information Discovery12	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol11	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing23	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
NEW PRICE ENQUIRY FROM PHILLIPINES.exe	34%	Virustotal		Browse
NEW PRICE ENQUIRY FROM PHILLIPINES.exe	29%	Metadefender		Browse
NEW PRICE ENQUIRY FROM PHILLIPINES.exe	49%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	29%	Metadefender		Browse
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	49%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Download
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
18.0.dhcpmon.exe.400000.4.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.2.dhcpmon.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack	100%	Avira	TR/NanoCore.fadte	Download File
18.0.dhcpmon.exe.400000.10.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.dhcpmon.exe.400000.4.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
18.0.dhcpmon.exe.400000.12.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
18.0.dhcpmon.exe.400000.8.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
18.0.dhcpmon.exe.400000.6.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.dhcpmon.exe.400000.6.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
18.2.dhcpmon.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.dhcpmon.exe.400000.12.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.dhcpmon.exe.400000.10.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.dhcpmon.exe.400000.8.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://micolous.id.au/projects/bf21	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.pcgamingboards.com/smf/index.php?topic=129.msg279#msg279	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.totalbf2142.com/forums/showthread.php?t=5342	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://micolous.id.au/projects/bf2142/.	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://micolous.id.au/	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://micolous.id.au/projects/bf2142/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kashbilly.ddns.net	197.211.59.104	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://igaeditor.sourceforge.net/wiki/	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://ati.amd.com/developer/compressonator.html	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://www.fontbureau.com/designers/?	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
https://sourceforge.net/project/showfiles.php?group_id=181663Mhttp://igaeditor.sourceforge.net/wiki/	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://igaeditor.sourceforge.net/	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, dhcpmon.exe, 0000000B.00000002.440433881.0000000006CA0000.00000004.00020000.sdmp	false		high
http://www.fontbureau.com/designers?	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://igaeditor.sourceforge.net/latest.txt	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://www.radgametools.com/bnkdown.htm	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://developer.nvidia.com/object/dds_thumbnail_viewer.html	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://micolous.id.au/projects/bf21	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.pcgamingboards.com/smf/index.php?topic=129.msg279#msg279	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://igaeditor.sourceforge.net/ohttp://www.totalbf2142.com/forums/showthread.php?t=5342Whttp://iga	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	false		high
http://www.goodfont.co.kr	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.gimp.org/windows/	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	false		high
http://www.carterandcone.coml	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.totalbf2142.com/forums/showthread.php?t=5342	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false	Avira URL Cloud: safe	unknown
http://registry.gimp.org/plugin?id=4816	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
https://sourceforge.net/svn/?group_id=181663	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://www.jiyu-kobo.co.jp/	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://sourceforge.net/project/showfiles.php?group_id=181663	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://www.fontbureau.com/designers8	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://micolous.id.au/projects/bf2142/.	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://developer.nvidia.com/object/photoshop_dds_plugins.html	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://www.zhongyicts.com.cn	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://developer.nvidia.com/object/photoshop_dds_plugins.htmlyhttp://developer.nvidia.com/object/dds	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	false		high
http://micolous.id.au/	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.379123716.0000000007C20000.00000004.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.412733612.0000000006B30000.00000004.00020000.sdmp, dhcpmon.exe, 00000008.00000002.418987180.0000000007370000.00000004.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.440433881.0000000006CA0000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://micolous.id.au/projects/bf2142/	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.379123716.0000000007C20000.00000004.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.412733612.0000000006B30000.00000004.00020000.sdmp, dhcpmon.exe, 00000008.00000002.418987180.0000000007370000.00000004.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.440433881.0000000006CA0000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
197.211.59.104	kashbilly.ddns.net	Nigeria		37148	globacom-asNG	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	552509
Start date:	13.01.2022
Start time:	13:16:18
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@22/8@7/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 1% (good quality ratio 0.8%) Quality average: 60.1% Quality standard deviation: 34.3%
HCA Information:	Successful, ratio: 96% Number of executed functions: 196 Number of non-executed functions: 7
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:17:30	API Interceptor	907x Sleep call for process: NEW PRICE ENQUIRY FROM PHILLIPINES.exe modified
13:17:38	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
13:17:39	Task Scheduler	Run new task: DHCP Monitor path: "C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe" s>$(Arg0)
13:17:42	Task Scheduler	Run new task: DHCP Monitor Task path: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" s>$(Arg0)
13:17:45	API Interceptor	2x Sleep call for process: dhcpmon.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Download File
Process:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	784384
Entropy (8bit):	7.771015792978407
Encrypted:	false
SSDEEP:	12288:jOi+lUcXEM6qtPn8tbobGFuWWBJxMDL08n1bimg9jnwHF6KmB5I:6i8XE+P8tb5uWWBM30UbejnsGBW
MD5:	CA0D3CA986E592EC436052F747F833C0
SHA1:	8BDB8EBEA5444C42C75C0B30AC8628D06C6CBCE0
SHA-256:	5E4CCF3D7A2885AB1F1CE83B855EC6F8B771B1731FAD4807F8D57B250A5505AD
SHA-512:	87B8DDE119068E43BEF447A59523565291392F949AFFA3F5F17713A9FCFD0D7C6F466D0E1C0D0F01F8B779A0753279A291C3CB4CA6E604EFB54E390896FD26B3
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 49%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3.a................................. ... ....@.. ....................................@.....................................K....@..L....................`......Q................................................ ............... ..H............text........ ...................... ..`.sdata....... ......................@....rsrc...L....@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NEW PRICE ENQUIRY FROM PHILLIPINES.exe.log Download File
Process:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1310
Entropy (8bit):	5.345651901398759
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE47mE4Ko88:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKz6
MD5:	D918C6A765EDB90D2A227FE23A3FEC98
SHA1:	8BA802AD8D740F114783F0DADC407CBFD2A209B3
SHA-256:	AB0E9F716E31502A4C6786575C5E64DFD9D24AF99056BBE2640A2FA322CFF4D6
SHA-512:	A937ABD8294BB32A612F8B3A376C94111D688379F0A4DB9FAA2FCEB71C25E18D621EEBCFDA5706B71C8473A4F38D8B3C4005D1589B564F9B1C9C441B6D337814
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1310
Entropy (8bit):	5.345651901398759
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE47mE4Ko88:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKz6
MD5:	D918C6A765EDB90D2A227FE23A3FEC98
SHA1:	8BA802AD8D740F114783F0DADC407CBFD2A209B3
SHA-256:	AB0E9F716E31502A4C6786575C5E64DFD9D24AF99056BBE2640A2FA322CFF4D6
SHA-512:	A937ABD8294BB32A612F8B3A376C94111D688379F0A4DB9FAA2FCEB71C25E18D621EEBCFDA5706B71C8473A4F38D8B3C4005D1589B564F9B1C9C441B6D337814
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Temp\tmp1E56.tmp Download File
Process:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1327
Entropy (8bit):	5.13500670090371
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0VC0xtn:cbk4oL600QydbQxIYODOLedq3Z0j
MD5:	552FA7AF5F278BF5AC6355B61EFF095D
SHA1:	DD4F276FA31AEB75DE477977A807CEE673B5560A
SHA-256:	94E06F5F5470FA4BDC3EB130222C8352A763C2CEC568029C89808427C979A88A
SHA-512:	5E3ABBDDBCA04376DDF72301BDE566A09543CE9D0DF4A2B5EE69AA755FFF151662E2013DAFEEDDEC722D23E1E23F90DAA36B0CDF8D0D7222296A2D2027FBD9D8
Malicious:	true
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Local\Temp\tmp3019.tmp Download File
Process:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1310
Entropy (8bit):	5.109425792877704
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0R3xtn:cbk4oL600QydbQxIYODOLedq3S3j
MD5:	5C2F41CFC6F988C859DA7D727AC2B62A
SHA1:	68999C85FC7E37BAB9216E0099836D40D4545C1C
SHA-256:	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
SHA-512:	B5DA5DA378D038AFBF8A7738E47921ED39F9B726E2CAA2993D915D9291A3322F94EFE8CCA6E7AD678A670DB19926B22B20E5028460FCC89CEA7F6635E7557334
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:n78:g
MD5:	4FAF345031681B7C40273BC270C99E93
SHA1:	6660712EC422C5B5B9D93EB34CD741DA8316E92B
SHA-256:	4BC0DAC6D0EFDF3534421E795FABFC7943B0ACCC6ECCF113DEFBBD5EA9D7FF54
SHA-512:	6B9B03BE05E6804C27D953E6B57317090F4874E7E545442BB04608BEBB6970EBB22079809FCDF9CF15FB4825373CA2398E6D7757CF5349CD836A47AA65BC05D2
Malicious:	true
Reputation:	unknown
Preview:	M.=....H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat Download File
Process:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.683114454101657
Encrypted:	false
SSDEEP:	3:oNN2+WrHk2yJn:oNN2RY2Y
MD5:	E26B66631E3B80974878501C3F4E3923
SHA1:	8F9E67EF46D390D95BC032028B6D3C3C66F02504
SHA-256:	09DC45D6D6EEE1813B8F6FD9F73632C6FD99E6E1C5AD63FCF024FC48BEBE2342
SHA-512:	BCC92B9669351D76C9AD44393BD52269DF2C033B80D5FA2B6902D72EAD8FEFCF931B8D3B64FB5B18ABDEB9795FD7565DE68E2596E513BDA1F2C79C4A8BAD3612
Malicious:	false
Reputation:	unknown
Preview:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.771015792978407
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File size:	784384
MD5:	ca0d3ca986e592ec436052f747f833c0
SHA1:	8bdb8ebea5444c42c75c0b30ac8628d06c6cbce0
SHA256:	5e4ccf3d7a2885ab1f1ce83b855ec6f8b771b1731fad4807f8d57b250a5505ad
SHA512:	87b8dde119068e43bef447a59523565291392f949affa3f5f17713a9fcfd0d7c6f466d0e1c0d0f01f8b779a0753279a291c3cb4ca6e604efb54e390896fd26b3
SSDEEP:	12288:jOi+lUcXEM6qtPn8tbobGFuWWBJxMDL08n1bimg9jnwHF6KmB5I:6i8XE+P8tb5uWWBM30UbejnsGBW
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3.a................................. ... ....@.. ....................................@................................

Static PE Info

General
Entrypoint:	0x4c06ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61DE33C2 [Wed Jan 12 01:49:54 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc06a0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x54c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc0651	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xbe6f4	0xbe800	False	0.887363383776	data	7.78570516551	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.sdata	0xc2000	0x204	0x400	False	0.458984375	data	4.099059951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xc4000	0x54c	0x600	False	0.341145833333	data	2.76865116557	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc6000	0xc	0x200	False	0.041015625	data	0.0776331623432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xc40e8	0xb0	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xc4198	0x14	data
RT_VERSION	0xc41ac	0x3a0	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright micolous 2006-2007
Assembly Version	0.1.6.0
InternalName	PermissionSetAttribu.exe
FileVersion	0.1.6.0
CompanyName	micolous
LegalTrademarks
Comments
ProductName	IGA Ad Cache Editor
ProductVersion	0.1.6.0
FileDescription	IGA Ad Cache Editor
OriginalFilename	PermissionSetAttribu.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/13/22-13:17:42.583459	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	64267	8.8.8.8	192.168.2.6
01/13/22-13:17:59.424978	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	60342	8.8.8.8	192.168.2.6
01/13/22-13:18:51.386646	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	54982	8.8.8.8	192.168.2.6
01/13/22-13:19:10.154501	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	50010	8.8.8.8	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2022 13:17:42.602291107 CET	49757	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:17:45.600858927 CET	49757	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:17:51.617057085 CET	49757	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:17:59.467313051 CET	49760	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:02.477304935 CET	49760	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:08.477777958 CET	49760	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:16.771198988 CET	49767	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:19.931900024 CET	49767	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:25.932369947 CET	49767	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:33.630498886 CET	49812	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:36.730123997 CET	49812	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:42.730626106 CET	49812	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:51.395036936 CET	49820	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:54.403465986 CET	49820	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:19:00.422612906 CET	49820	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:19:10.156089067 CET	49847	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:19:13.152012110 CET	49847	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:19:19.168152094 CET	49847	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:19:28.224725008 CET	49849	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:19:31.231589079 CET	49849	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:19:37.233083963 CET	49849	6060	192.168.2.6	197.211.59.104

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2022 13:17:42.564188957 CET	64267	53	192.168.2.6	8.8.8.8
Jan 13, 2022 13:17:42.583458900 CET	53	64267	8.8.8.8	192.168.2.6
Jan 13, 2022 13:17:59.405607939 CET	60342	53	192.168.2.6	8.8.8.8
Jan 13, 2022 13:17:59.424978018 CET	53	60342	8.8.8.8	192.168.2.6
Jan 13, 2022 13:18:16.749871969 CET	58384	53	192.168.2.6	8.8.8.8
Jan 13, 2022 13:18:16.769443035 CET	53	58384	8.8.8.8	192.168.2.6
Jan 13, 2022 13:18:33.609488964 CET	50339	53	192.168.2.6	8.8.8.8
Jan 13, 2022 13:18:33.628575087 CET	53	50339	8.8.8.8	192.168.2.6
Jan 13, 2022 13:18:51.365160942 CET	54982	53	192.168.2.6	8.8.8.8
Jan 13, 2022 13:18:51.386646032 CET	53	54982	8.8.8.8	192.168.2.6
Jan 13, 2022 13:19:10.133548021 CET	50010	53	192.168.2.6	8.8.8.8
Jan 13, 2022 13:19:10.154500961 CET	53	50010	8.8.8.8	192.168.2.6
Jan 13, 2022 13:19:28.203470945 CET	62116	53	192.168.2.6	8.8.8.8
Jan 13, 2022 13:19:28.220710039 CET	53	62116	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 13, 2022 13:17:42.564188957 CET	192.168.2.6	8.8.8.8	0x2e71	Standard query (0)	kashbilly.ddns.net	A (IP address)	IN (0x0001)
Jan 13, 2022 13:17:59.405607939 CET	192.168.2.6	8.8.8.8	0x6c08	Standard query (0)	kashbilly.ddns.net	A (IP address)	IN (0x0001)
Jan 13, 2022 13:18:16.749871969 CET	192.168.2.6	8.8.8.8	0xe1a1	Standard query (0)	kashbilly.ddns.net	A (IP address)	IN (0x0001)
Jan 13, 2022 13:18:33.609488964 CET	192.168.2.6	8.8.8.8	0xc4c4	Standard query (0)	kashbilly.ddns.net	A (IP address)	IN (0x0001)
Jan 13, 2022 13:18:51.365160942 CET	192.168.2.6	8.8.8.8	0x37c9	Standard query (0)	kashbilly.ddns.net	A (IP address)	IN (0x0001)
Jan 13, 2022 13:19:10.133548021 CET	192.168.2.6	8.8.8.8	0x6a08	Standard query (0)	kashbilly.ddns.net	A (IP address)	IN (0x0001)
Jan 13, 2022 13:19:28.203470945 CET	192.168.2.6	8.8.8.8	0x1b92	Standard query (0)	kashbilly.ddns.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jan 13, 2022 13:17:42.583458900 CET	8.8.8.8	192.168.2.6	0x2e71	No error (0)	kashbilly.ddns.net	197.211.59.104	A (IP address)	IN (0x0001)
Jan 13, 2022 13:17:59.424978018 CET	8.8.8.8	192.168.2.6	0x6c08	No error (0)	kashbilly.ddns.net	197.211.59.104	A (IP address)	IN (0x0001)
Jan 13, 2022 13:18:16.769443035 CET	8.8.8.8	192.168.2.6	0xe1a1	No error (0)	kashbilly.ddns.net	197.211.59.104	A (IP address)	IN (0x0001)
Jan 13, 2022 13:18:33.628575087 CET	8.8.8.8	192.168.2.6	0xc4c4	No error (0)	kashbilly.ddns.net	197.211.59.104	A (IP address)	IN (0x0001)
Jan 13, 2022 13:18:51.386646032 CET	8.8.8.8	192.168.2.6	0x37c9	No error (0)	kashbilly.ddns.net	197.211.59.104	A (IP address)	IN (0x0001)
Jan 13, 2022 13:19:10.154500961 CET	8.8.8.8	192.168.2.6	0x6a08	No error (0)	kashbilly.ddns.net	197.211.59.104	A (IP address)	IN (0x0001)
Jan 13, 2022 13:19:28.220710039 CET	8.8.8.8	192.168.2.6	0x1b92	No error (0)	kashbilly.ddns.net	197.211.59.104	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976 Parent PID: 4756

General

Start time:	13:17:22
Start date:	13/01/2022
Path:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe"
Imagebase:	0xd60000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.375378918.0000000003131000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296 Parent PID: 976

General

Start time:	13:17:30
Start date:	13/01/2022
Path:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Imagebase:	0xd30000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.630554205.0000000005910000.00000004.00020000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000002.00000002.630554205.0000000005910000.00000004.00020000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 4544 Parent PID: 6296

General

Start time:	13:17:35
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp
Imagebase:	0xa40000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4712 Parent PID: 4544

General

Start time:	13:17:37
Start date:	13/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384 Parent PID: 936

General

Start time:	13:17:39
Start date:	13/01/2022
Path:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe" 0
Imagebase:	0x110000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000005.00000002.405885407.00000000023F1000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 5096 Parent PID: 6296

General

Start time:	13:17:40
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp3019.tmp
Imagebase:	0xa40000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5396 Parent PID: 5096

General

Start time:	13:17:41
Start date:	13/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: dhcpmon.exe PID: 4800 Parent PID: 936

General

Start time:	13:17:42
Start date:	13/01/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0
Imagebase:	0x940000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000008.00000002.415561117.0000000002DE1000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 29%, Metadefender, Browse Detection: 49%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028 Parent PID: 6384

General

Start time:	13:17:43
Start date:	13/01/2022
Path:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Imagebase:	0xb30000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: dhcpmon.exe PID: 3832 Parent PID: 3440

General

Start time:	13:17:46
Start date:	13/01/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe"
Imagebase:	0x280000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: dhcpmon.exe PID: 5644 Parent PID: 4800

General

Start time:	13:17:46
Start date:	13/01/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Imagebase:	0x760000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: dhcpmon.exe PID: 6728 Parent PID: 3832

General

Start time:	13:17:51
Start date:	13/01/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Imagebase:	0x3c0000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: dhcpmon.exe PID: 6780 Parent PID: 3832

General

Start time:	13:17:53
Start date:	13/01/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Imagebase:	0x170000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: dhcpmon.exe PID: 6992 Parent PID: 3832

General

Start time:	13:17:56
Start date:	13/01/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Imagebase:	0xa40000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976 Parent PID: 4756 NEW PRICE ENQUIRY FROM PHILLIPINES.exeCOMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	103
Total number of Limit Nodes:	7

Executed Functions

Function 03109828, Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 03109A6E

Memory Dump Source

Source File: 00000000.00000002.375295598.0000000003100000.00000040.00000001.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3100000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 403527e5168d838370bea9f61658464dd953a7f61f9a3f906bc833bbfa439f14
Instruction ID: 77e70ca7577e4531f702e63e2d84000c82773dd03cc94e5e77f6238991d0ec27
Opcode Fuzzy Hash: 403527e5168d838370bea9f61658464dd953a7f61f9a3f906bc833bbfa439f14
Instruction Fuzzy Hash: 8D712370A00B098FD724DF2AD09175AB7F5FF88214F048A2ED49ADBA90DB74E845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0310405C, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 03105759

Memory Dump Source

Source File: 00000000.00000002.375295598.0000000003100000.00000040.00000001.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3100000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9da709704b22de821a2c85ca77b1f0e60958f453cee4993e685680061839e083
Instruction ID: cd72320bb438103933bac48e694dd3f3f6953de033354a6d63fc5619ac260776
Opcode Fuzzy Hash: 9da709704b22de821a2c85ca77b1f0e60958f453cee4993e685680061839e083
Instruction Fuzzy Hash: B241E271C0071CCBDB24DFA9C884B9EBBB6BF89304F648069D419AB291DBB56945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0310569D, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 03105759

Memory Dump Source

Source File: 00000000.00000002.375295598.0000000003100000.00000040.00000001.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3100000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a31faab15c89a6122682c94ee161ac83d32232ef2b3102d52e6d2aabfdf266ab
Instruction ID: aea0688b9a56eb34008fa4a184c4460c2560e71546732267f2f3684f9eb6ed8e
Opcode Fuzzy Hash: a31faab15c89a6122682c94ee161ac83d32232ef2b3102d52e6d2aabfdf266ab
Instruction Fuzzy Hash: BF41F371C00718CFDB14DFA9C984B8EBBB2BF49308F24806AD419AB291DBB56945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0310A584, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0310BCFE,?,?,?,?,?), ref: 0310BDBF

Memory Dump Source

Source File: 00000000.00000002.375295598.0000000003100000.00000040.00000001.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3100000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ae321b0a95a4ec508955b79752de70aefff83cee5b6319a748d26b16862c1131
Instruction ID: 2f7c16b8fd4470f7fc8acb7dae63af77ea6876df9f27150bad80163a0418e7bd
Opcode Fuzzy Hash: ae321b0a95a4ec508955b79752de70aefff83cee5b6319a748d26b16862c1131
Instruction Fuzzy Hash: 8921E3B59002589FDB10CF99D984ADEFBF4EB48324F14842AE925B3350D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0310BD30, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0310BCFE,?,?,?,?,?), ref: 0310BDBF

Memory Dump Source

Source File: 00000000.00000002.375295598.0000000003100000.00000040.00000001.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3100000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 43cc37e10ee0ee6f9eaf3764721c5edb92a41241232873a62028274832f1f1e7
Instruction ID: 9b563a8042e7a77ccd512bc3750256ccba33adb2f07213ff072be7797a81aa5f
Opcode Fuzzy Hash: 43cc37e10ee0ee6f9eaf3764721c5edb92a41241232873a62028274832f1f1e7
Instruction Fuzzy Hash: 8C21E6B59002199FDB10CF99D985ADEFBF4EF48324F14842AE815B3350D378A955CF61

Uniqueness

Uniqueness Score: -1.00%

Function 03108B80, Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,03109AE9,00000800,00000000,00000000), ref: 03109CFA

Memory Dump Source

Source File: 00000000.00000002.375295598.0000000003100000.00000040.00000001.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3100000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9ce3d90b3f876f89111b663a5939ccf43a69747d0c6d24f9a0e6a80aaa5c1672
Instruction ID: 62f796e830a0bae1b22bb95a23777322412d282fa526647bf5003ff9377066c6
Opcode Fuzzy Hash: 9ce3d90b3f876f89111b663a5939ccf43a69747d0c6d24f9a0e6a80aaa5c1672
Instruction Fuzzy Hash: 0711F4B6D003099BCB10CF9AC544A9EFBF4EB89224F14842AD429B7250C3B5A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 03109A08, Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 03109A6E

Memory Dump Source

Source File: 00000000.00000002.375295598.0000000003100000.00000040.00000001.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3100000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 030e73aab0a98540aab0d741175024b919023adc908da080ae9b28f5f409ea94
Instruction ID: ac66b341a47110a996e22e94d2851400512d72e7a046d3dcbd18070f2f288e6e
Opcode Fuzzy Hash: 030e73aab0a98540aab0d741175024b919023adc908da080ae9b28f5f409ea94
Instruction Fuzzy Hash: 8A11DFB6D00659CFCB10CF9AC844BDEFBF4EB88224F14852AD429B7650C3B9A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 076E2AD8, Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 076ED26D

Memory Dump Source

Source File: 00000000.00000002.378924779.00000000076E0000.00000040.00000001.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76e0000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f50b3086656a7f69992c6b8060083fe79dd88313bd78ac9b8964d9b9f4eb395a
Instruction ID: bb6cb20f46847bd05743117cfc91c7fc872365c605471d0fcd949ae34f3f91db
Opcode Fuzzy Hash: f50b3086656a7f69992c6b8060083fe79dd88313bd78ac9b8964d9b9f4eb395a
Instruction Fuzzy Hash: 371106B59003499FCB10DF99C489BDEBBF8EB48324F10841AE525B7300C375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0186D4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374942750.000000000186D000.00000040.00000001.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_186d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c8deeb7dfc63ee52c842a449b39a53445f44a4016aafc725967d641f2b50f1
Instruction ID: 385cbcf7d9f997a74d39d8da89754aeb2b7e3e275a9051048f0331b39bf937b4
Opcode Fuzzy Hash: a5c8deeb7dfc63ee52c842a449b39a53445f44a4016aafc725967d641f2b50f1
Instruction Fuzzy Hash: 63213671600344DFCB01DF54C8C4B26BF69FB8832CF248669E8458B646C336EA55CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0187D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374985217.000000000187D000.00000040.00000001.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_187d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a333a762ae6d9b7ce6065bc52c02ff4092f3d25d1ceec04cfb92a4f1a3ee6e
Instruction ID: 032e3a721611c953ab267d53e398f10f24573f0206e1077e6095b52ae64b5c16
Opcode Fuzzy Hash: 02a333a762ae6d9b7ce6065bc52c02ff4092f3d25d1ceec04cfb92a4f1a3ee6e
Instruction Fuzzy Hash: 6321F571614304EFDB05DF94D9C0B16BB65FF88328F24C66DD8498B242C73AE946CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0187D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374985217.000000000187D000.00000040.00000001.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_187d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ecfbdd806dee55d400e19ceaa8d00dceb3c4656a264eb00447277363b29c0a9
Instruction ID: 5a49b7dff2183a970261e6c9043a48c5b88580c848c1243e854acaea321f2e62
Opcode Fuzzy Hash: 3ecfbdd806dee55d400e19ceaa8d00dceb3c4656a264eb00447277363b29c0a9
Instruction Fuzzy Hash: 19210071604304DFCB16DF54D9C0B16BB61FF88368F24C66DD8098B286C33AD946CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0186D4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374942750.000000000186D000.00000040.00000001.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_186d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02300354f26ebcfd8d1f5fee0bd3ff538f9c080a3beecbef12d4a17bc3822e08
Instruction ID: 49e28574a65a33c07ce87939f07b8bbdb362fc22a724e1a7f9c4ed11ff23582d
Opcode Fuzzy Hash: 02300354f26ebcfd8d1f5fee0bd3ff538f9c080a3beecbef12d4a17bc3822e08
Instruction Fuzzy Hash: 2311D376504280CFCF12CF54D9C4B16BF71FB84328F28C6AAE8454B616C336D556CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0187D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374985217.000000000187D000.00000040.00000001.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_187d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6eb60a70ec0ca554554800ef63ac3af12c64d97730370158fb293fa66ec475
Instruction ID: 6126b9ace0a729a7a318453885d6e155c8388c43966e863dd23dde780ac751bb
Opcode Fuzzy Hash: 3a6eb60a70ec0ca554554800ef63ac3af12c64d97730370158fb293fa66ec475
Instruction Fuzzy Hash: F911BB75504280CFCB12CF14D9C4B15BBA1FB84328F28C6AAD8098B656C33AD55ACFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0187D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374985217.000000000187D000.00000040.00000001.sdmp, Offset: 0187D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_187d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6eb60a70ec0ca554554800ef63ac3af12c64d97730370158fb293fa66ec475
Instruction ID: b8f6df19627f161bf09c5cb6d35ecc231e3b6b1f20e2f2c31c8fa3391eb7ce4d
Opcode Fuzzy Hash: 3a6eb60a70ec0ca554554800ef63ac3af12c64d97730370158fb293fa66ec475
Instruction Fuzzy Hash: DB11BB75504280DFCB02CF54C5C0B15BFA1FF84324F28C6AED8498B656C33AE44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0186D731, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374942750.000000000186D000.00000040.00000001.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_186d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8328cc89827b6f5a0bd137e58fe61157e7e01e6b74123ab2fd25127145828e88
Instruction ID: f483b43a2ce9b8388caefdc47bf7984ee510132ce04561dd3bc17b0a9cb0eb6d
Opcode Fuzzy Hash: 8328cc89827b6f5a0bd137e58fe61157e7e01e6b74123ab2fd25127145828e88
Instruction Fuzzy Hash: C301D8315043849AE7104A698C84766BBDCDF45368F18C629ED449A282D77C9940C6B2

Uniqueness

Uniqueness Score: -1.00%

Function 0186D730, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374942750.000000000186D000.00000040.00000001.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_186d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2926197c4d5e9a30baad0a26e69350efd781578a4762c200875244f1b2892fb6
Instruction ID: 9eb483e6c9d47f91cd75c6469bd1a702950722487236cf973fa4ebae25ffa7a4
Opcode Fuzzy Hash: 2926197c4d5e9a30baad0a26e69350efd781578a4762c200875244f1b2892fb6
Instruction Fuzzy Hash: 7EF062765043849BEB118E19CCC4B62FF9CEB81778F18C56AED485F286C3789944CAB2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0310E9F8, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.375295598.0000000003100000.00000040.00000001.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3100000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1970c88b85de23fb1db2477e1ec1d585eb7c6251ecaee014da11b734e68f2c61
Instruction ID: 2d55380d16fd0c2fd1f94d4fc620fbf2fd6807321d52d93ec3f85e9a6b4ccf96
Opcode Fuzzy Hash: 1970c88b85de23fb1db2477e1ec1d585eb7c6251ecaee014da11b734e68f2c61
Instruction Fuzzy Hash: 0712DBF1421B468BD310CF65E58A1893FE1B741329F91420AF2A19BED0EFB4116EEF64

Uniqueness

Uniqueness Score: -1.00%

Function 0310C3F4, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.375295598.0000000003100000.00000040.00000001.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3100000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c457a473700f91c183be27ab8154b6aeb40c0e6c4ceb743796b9097ca46ae1f
Instruction ID: a454ca8cc630f054e7291dd39937b0300852b547c6f901638ec0bd72f5b1f2d9
Opcode Fuzzy Hash: 4c457a473700f91c183be27ab8154b6aeb40c0e6c4ceb743796b9097ca46ae1f
Instruction Fuzzy Hash: DBA19E36E00619CFCF05DFB5C98459EBBB2FF88300B15856AE806AF261DB71A905CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0310E9E8, Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.375295598.0000000003100000.00000040.00000001.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3100000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0a7f5080ab29d66ef654399090f5fa620268dbf8a0530bb5264f55edad4d3a
Instruction ID: 69b109b040f9e3d4a4b835f0afb265775908121baff1320c67c1e50323c3bcfe
Opcode Fuzzy Hash: 4e0a7f5080ab29d66ef654399090f5fa620268dbf8a0530bb5264f55edad4d3a
Instruction Fuzzy Hash: 91C130B14217068BD310DF65E98A2897FB1FB45329F51420AF1A1ABAD0FFB4106EEF54

Uniqueness

Uniqueness Score: -1.00%

Function 076E3568, Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.378924779.00000000076E0000.00000040.00000001.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76e0000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7372d075234f29b9f4b6a492a884b81f099bca5e2d8ebcd1979199f6290c7bf
Instruction ID: de672cf100d23fe7f741d847a801686a1bec738e4f237c9c83f20459ab771346
Opcode Fuzzy Hash: d7372d075234f29b9f4b6a492a884b81f099bca5e2d8ebcd1979199f6290c7bf
Instruction Fuzzy Hash: 465171B4E0024D8FD748DFBAE84169E7BF6FB86304F04C529D40A9B394EF385A558B52

Uniqueness

Uniqueness Score: -1.00%

Function 076E35B0, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.378924779.00000000076E0000.00000040.00000001.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76e0000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c115374d3f9c02f54c64dc598e413ef1962e08eabf3119c715ee04a47094a400
Instruction ID: 475573b921dacff5fb355f6a8753116c8e5ce863de0e3de168d3081f2d2f242a
Opcode Fuzzy Hash: c115374d3f9c02f54c64dc598e413ef1962e08eabf3119c715ee04a47094a400
Instruction Fuzzy Hash: AF517174E0020D8FD748EFBAE85169E7BF6FB85304F04C529D40A9B3A4EB385A558B42

Uniqueness

Uniqueness Score: -1.00%

Function 076E35C0, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.378924779.00000000076E0000.00000040.00000001.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76e0000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b978d1cce03a0c88f7278664b888221f69c55b0ad35c590e45cec24411e59a3
Instruction ID: d6553529b037534f9bd924d61924752911e6806bffc33c1fbd833af7bc8036c5
Opcode Fuzzy Hash: 6b978d1cce03a0c88f7278664b888221f69c55b0ad35c590e45cec24411e59a3
Instruction Fuzzy Hash: 99513E74E0020D8FD748EFBAE85169E7BF6FB85304F04C529D40A9B3A4EB385A55CB52

Uniqueness

Uniqueness Score: -1.00%

Function 076EBFE8, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.378924779.00000000076E0000.00000040.00000001.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76e0000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf375c714c5df271d1efcc901833dd2d82c8858cee8a535605681f8f3dbdc86
Instruction ID: da3f34970cdffc22d905515bb9d7907a9564e35170fe887c08bb2894249f3da6
Opcode Fuzzy Hash: abf375c714c5df271d1efcc901833dd2d82c8858cee8a535605681f8f3dbdc86
Instruction Fuzzy Hash: F021BEB1D056198BEB28CF6B8D0479EF6F7AFC9704F14C0BAC819A7255EB3049858E60

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296 Parent PID: 976 NEW PRICE ENQUIRY FROM PHILLIPINES.exeCOMMON

Execution Graph

Execution Coverage:	16.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	199
Total number of Limit Nodes:	10

Executed Functions

Function 0161B6C0, Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0161B730
GetCurrentThread.KERNEL32 ref: 0161B76D
GetCurrentProcess.KERNEL32 ref: 0161B7AA
GetCurrentThreadId.KERNEL32 ref: 0161B803

Memory Dump Source

Source File: 00000002.00000002.627584152.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1610000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 20a435009b2231ecb16ddfcec5257221f189bb8d44f98b13109433ce036e417c
Instruction ID: b4b10d615c6cbd5d3fda1b9a94a9b629d28a02eff8d9438bd5b414a835eab889
Opcode Fuzzy Hash: 20a435009b2231ecb16ddfcec5257221f189bb8d44f98b13109433ce036e417c
Instruction Fuzzy Hash: 4C5166B49013488FDB15CFA9C9487DEBBF0AF89318F28846AE419A7390C7746985CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0161B6D0, Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0161B730
GetCurrentThread.KERNEL32 ref: 0161B76D
GetCurrentProcess.KERNEL32 ref: 0161B7AA
GetCurrentThreadId.KERNEL32 ref: 0161B803

Memory Dump Source

Source File: 00000002.00000002.627584152.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1610000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5c289689f33ae4172b1ea0edacaaa2e1cd72f63c604e981ea6785069611df6b2
Instruction ID: 8c71ef7f5a31ca5d95a855b51bf2967d40b6016cbc4df3a591fe1992f26f296a
Opcode Fuzzy Hash: 5c289689f33ae4172b1ea0edacaaa2e1cd72f63c604e981ea6785069611df6b2
Instruction Fuzzy Hash: A55146B49007498FDB14CFA9D9487DEBBF1BF88314F24846AE019A7350C7746985CF65

Uniqueness

Uniqueness Score: -1.00%

Function 06BE3549, Relevance: 1.7, APIs: 1, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.631234001.0000000006BE0000.00000040.00000001.sdmp, Offset: 06BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6be0000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 237cc36f17ad916c364d74ef42207e7fc102a54924688c085423e399f67da856
Instruction ID: 176ee7fc7703a570cd1c3ffe340f97fc64b8553820bc8df952f95de02bac82fb
Opcode Fuzzy Hash: 237cc36f17ad916c364d74ef42207e7fc102a54924688c085423e399f67da856
Instruction Fuzzy Hash: B58169B1D04309DFDB10DFA9C880AEEBBF1FF89314F20856AD415AB251DB74A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 016193E8, Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0161962E

Memory Dump Source

Source File: 00000002.00000002.627584152.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1610000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 66b27ed9ffd5d660cd79cc398062f65588ffedab0458880fc914f2cb16ebe427
Instruction ID: c26922eb37bca4c789dd12f0f7f4bee46f33b49a072735b40b928759c464acc8
Opcode Fuzzy Hash: 66b27ed9ffd5d660cd79cc398062f65588ffedab0458880fc914f2cb16ebe427
Instruction Fuzzy Hash: A2712270A00B058FD764CF2AD45166ABBF1BF88318F048A2ED58ADBB54D734E8158F91

Uniqueness

Uniqueness Score: -1.00%

Function 05796136, Relevance: 1.7, APIs: 1, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.630373034.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5790000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f92a4a119f4dd5a187cf23f447e169012dc54ff68a2a258e3a2b0b15590a1343
Instruction ID: 36a34321b24e15c1b3b4f0aacb42f2f6885a508c28e0809f7605ed6456ffdf10
Opcode Fuzzy Hash: f92a4a119f4dd5a187cf23f447e169012dc54ff68a2a258e3a2b0b15590a1343
Instruction Fuzzy Hash: 767146B0D042189FDF18CFA8D884B9EBBB1BF49314F148629E815AB391DB749845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05791A4C, Relevance: 1.7, APIs: 1, Instructions: 185
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExA.KERNELBASE(00000000,05795F31,00020119,00000000,00000000,?), ref: 057962FF

Memory Dump Source

Source File: 00000002.00000002.630373034.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5790000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 086457a5bcb613d22c15c93601350844cb09dcd437efa27df072e28e55f3831f
Instruction ID: 356f9a54b1cafccc1bfdb6bb9e3bbbd11af3cc5e77a2469953ddc9e11fb0e4f9
Opcode Fuzzy Hash: 086457a5bcb613d22c15c93601350844cb09dcd437efa27df072e28e55f3831f
Instruction Fuzzy Hash: F9713970D04218DFDF18CFA9D884BAEBBB1BF49314F148529E819AB391DB749845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06BE18F5, Relevance: 1.6, APIs: 1, Instructions: 144
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DnsQuery_A.DNSAPI(?,?,?,?,?,?), ref: 06BE3738

Memory Dump Source

Source File: 00000002.00000002.631234001.0000000006BE0000.00000040.00000001.sdmp, Offset: 06BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6be0000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: Query_
String ID:
API String ID: 428220571-0
Opcode ID: ea0534ef30decd29a2ca0b6fd4381653bcef630967954acc93a6093217ad8984
Instruction ID: 3ce4229b339244d057562106ef24c98353e4f367e274c43442c981e00960da86
Opcode Fuzzy Hash: ea0534ef30decd29a2ca0b6fd4381653bcef630967954acc93a6093217ad8984
Instruction Fuzzy Hash: 265123B1D002089FDB10CFA9C880BDDBBF1FF48304F24856AE814AB250DB74A845CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06BE18FC, Relevance: 1.6, APIs: 1, Instructions: 140
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DnsQuery_A.DNSAPI(?,?,?,?,?,?), ref: 06BE3738

Memory Dump Source

Source File: 00000002.00000002.631234001.0000000006BE0000.00000040.00000001.sdmp, Offset: 06BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6be0000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: Query_
String ID:
API String ID: 428220571-0
Opcode ID: c898bb44d811c3da431d1375bfa5773f00352d7cd882411d13eee099c3771521
Instruction ID: 633bfcb07b16b95ef7e1f55c1d063f3eb97e46e5928e69716ddd11fcaaef056c
Opcode Fuzzy Hash: c898bb44d811c3da431d1375bfa5773f00352d7cd882411d13eee099c3771521
Instruction Fuzzy Hash: 0A51F1B1D002189FDB50CFA9C881BDEBBF1FF48314F24856AE819AB250DB74A945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0161FBEC, Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0161FD0A

Memory Dump Source

Source File: 00000002.00000002.627584152.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1610000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 21e0a6b7d51d39d0d85a0d279b2431e5f143a917939665b0cfb52b4c7cc47892
Instruction ID: 1a6ca0012c7c7bf9bbc4cb1cf67b442c2fab5307925e20a3eb46b49996164dc0
Opcode Fuzzy Hash: 21e0a6b7d51d39d0d85a0d279b2431e5f143a917939665b0cfb52b4c7cc47892
Instruction Fuzzy Hash: C651D2B1D00349DFDB14CF99C884ADEBBB1FF88314F64856AE429AB214D774A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0161FBF8, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0161FD0A

Memory Dump Source

Source File: 00000002.00000002.627584152.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1610000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 45b08318f2ecaed53d974f337c80b7aa1f74ac914e61d92b604512917a294d5b
Instruction ID: f4edda1e56f316cd4e24957bf01af27353abfa84b61e57acc82fff176e36b0f6
Opcode Fuzzy Hash: 45b08318f2ecaed53d974f337c80b7aa1f74ac914e61d92b604512917a294d5b
Instruction Fuzzy Hash: FE41C0B1D00308DFDB14CF99C884ADEBBB5FF88314F64852AE819AB214D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05795FBC, Relevance: 1.6, APIs: 1, Instructions: 103
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?), ref: 057960AF

Memory Dump Source

Source File: 00000002.00000002.630373034.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5790000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8a47fe2bc2c9a32b54fb75f8fd63798bb98998a4d71692c01677c865769d8817
Instruction ID: d2525577ba3401714c943ee9f1b15dd3f94e50c6f897bf57a38e708914b3e7e7
Opcode Fuzzy Hash: 8a47fe2bc2c9a32b54fb75f8fd63798bb98998a4d71692c01677c865769d8817
Instruction Fuzzy Hash: 894145B1D003589FCF14CF99D885B9EBBB1BF48314F14862AE818AB240DB759845DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05791A40, Relevance: 1.6, APIs: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?), ref: 057960AF

Memory Dump Source

Source File: 00000002.00000002.630373034.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5790000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 835ae3b60e7af04d64ebd8637acaf17712d32f92c02b71ed2632c252e48f5a27
Instruction ID: ed6b06a33e3b02ced98c3133ba7dc2369eeb0b95b2254770a211d15674ed2aea
Opcode Fuzzy Hash: 835ae3b60e7af04d64ebd8637acaf17712d32f92c02b71ed2632c252e48f5a27
Instruction Fuzzy Hash: 074155B0D00758DFCF14CF99D885B9EBBB1BF48314F10862AE819AB240DB749845DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05798A26, Relevance: 1.6, APIs: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNELBASE(?), ref: 05798B04

Memory Dump Source

Source File: 00000002.00000002.630373034.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5790000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 215592071eba854b627859e5e7fc740bcbfec57801cc0958994622004d4d8d24
Instruction ID: 43ea22a38531e46ee7dbefde6307217c9ea9048d961e8aa9dafeccde37914cd2
Opcode Fuzzy Hash: 215592071eba854b627859e5e7fc740bcbfec57801cc0958994622004d4d8d24
Instruction Fuzzy Hash: E84168B1D006188FDF14CFA9D94579EBBF1FB49314F188529D815AB380D7749846CF92

Uniqueness

Uniqueness Score: -1.00%

Function 05798A30, Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNELBASE(?), ref: 05798B04

Memory Dump Source

Source File: 00000002.00000002.630373034.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5790000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d95efb2022e581d56282bb62a38c66eb86f05f84d8474f1405578a06c96c68d8
Instruction ID: 00758308f0e368a3adabc29a5b94738a630aa9762cae78690e6cb8021cc9fd3c
Opcode Fuzzy Hash: d95efb2022e581d56282bb62a38c66eb86f05f84d8474f1405578a06c96c68d8
Instruction Fuzzy Hash: 1B3157B1D002188FDF14CFA9D885B9EBBF1FB49314F188529E815A7380D774A846CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 05795A58, Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.630373034.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5790000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf83c8cd2c81c9b277ed1311e53a4184d01229e282233e7aed889f58ce35c85f
Instruction ID: 8af7fd42d6c1218503b436b409d40a4d822897847bcb4bb9aaa97149b57870d7
Opcode Fuzzy Hash: bf83c8cd2c81c9b277ed1311e53a4184d01229e282233e7aed889f58ce35c85f
Instruction Fuzzy Hash: 803126B180D3948FCB06EFA9D8946DABFF0EF56254F0540ABC055AB292D7346504DB72

Uniqueness

Uniqueness Score: -1.00%

Function 0161BCF9, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0161BD87

Memory Dump Source

Source File: 00000002.00000002.627584152.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1610000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bd92c96acc38cf5d5589601a9d090235241ee4ebbaf031a348aa10c021f9e560
Instruction ID: 7f30298f7932212bfb44900e1ef446f57f68a913e698ce3e3095b06e70d42880
Opcode Fuzzy Hash: bd92c96acc38cf5d5589601a9d090235241ee4ebbaf031a348aa10c021f9e560
Instruction Fuzzy Hash: 6521E5B5D002489FDB10CF99D884ADEBFF4EB48324F14842AE958A3350C778A955CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0161BD00, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0161BD87

Memory Dump Source

Source File: 00000002.00000002.627584152.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1610000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7608d148767a6edb4052f59b057fda2fa2e527a68534d83bd9a7823c5eb1a96b
Instruction ID: 3d4557c370002419ee73c4ba0e3a61044bee5c650f4091d8cfe73bc3ce58bfbc
Opcode Fuzzy Hash: 7608d148767a6edb4052f59b057fda2fa2e527a68534d83bd9a7823c5eb1a96b
Instruction Fuzzy Hash: 0F21C4B5D00248DFDB10CF99D985ADEBBF4EB48324F14842AE918A3350D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01619849, Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,016196A9,00000800,00000000,00000000), ref: 016198BA

Memory Dump Source

Source File: 00000002.00000002.627584152.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1610000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2d376dab9f8cfbc914c9fac1b78027e34dc0ce0d5d57b34a014305d84452e177
Instruction ID: f2a836ca8a2678135e2e32f97dbbe9762774af1fabbc6ffd4dad02d53fa02125
Opcode Fuzzy Hash: 2d376dab9f8cfbc914c9fac1b78027e34dc0ce0d5d57b34a014305d84452e177
Instruction Fuzzy Hash: 7721F4B6C00349DFDB10CFAAC844BDEBBF4AB89354F15846AD825A7700C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01618768, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,016196A9,00000800,00000000,00000000), ref: 016198BA

Memory Dump Source

Source File: 00000002.00000002.627584152.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1610000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 733ba392e8568d5c93cbd00a36d0e0296c48b10a6258e1087478f1342d575a80
Instruction ID: b3f26d78e47a32fd365fd20279dbc6c592ca90d9c93920a825a6115e9554e903
Opcode Fuzzy Hash: 733ba392e8568d5c93cbd00a36d0e0296c48b10a6258e1087478f1342d575a80
Instruction Fuzzy Hash: 6A11F4B6D00209CBDB10CF9AC844B9EBBF4EB88364F15842AD929A7700C374A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 016195C8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0161962E

Memory Dump Source

Source File: 00000002.00000002.627584152.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1610000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 36df7d2b873626c3828dc0ae4eda233d3b7a8b52831c730b90cd9c9f7d1eed37
Instruction ID: 0689cb57a0e421fdfe151ee6afad0b6e2841788a4680bb85b181fed51d539627
Opcode Fuzzy Hash: 36df7d2b873626c3828dc0ae4eda233d3b7a8b52831c730b90cd9c9f7d1eed37
Instruction Fuzzy Hash: 5A11D2B6D006598FDB10CF9AC845BDEFBF4EB89328F14882AD429A7600C374A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0161FE38, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0161FE9D

Memory Dump Source

Source File: 00000002.00000002.627584152.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1610000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 09b9ceb5b7e92fdaea9bef5cad8e63981b570b51e21f081c1cf78d829c847c00
Instruction ID: 4929298ed840e03b563a8d18bb193408f0dbe73256e343877346ba464bbfaef2
Opcode Fuzzy Hash: 09b9ceb5b7e92fdaea9bef5cad8e63981b570b51e21f081c1cf78d829c847c00
Instruction Fuzzy Hash: 1B1113B1800249DFDB10CF99C585BDEBBF4EB88324F14845AD864A7641C374A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05790438, Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0579049D

Memory Dump Source

Source File: 00000002.00000002.630373034.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5790000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 09e58755a8849c8f70dc84653b9c8a0e920b9cb4d2872f1d6f7b096e49c45ab7
Instruction ID: 6f8399dc2d3e4dfa859433024f3317868264b9dc5d87ed4ead294505a0f63d7f
Opcode Fuzzy Hash: 09e58755a8849c8f70dc84653b9c8a0e920b9cb4d2872f1d6f7b096e49c45ab7
Instruction Fuzzy Hash: C411E0B1C007598FCB14CF9AE444B9EBBF4EB89224F14856AD829A3250D378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 057963CA, Relevance: 1.5, APIs: 1, Instructions: 46registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(00000000), ref: 0579642F

Memory Dump Source

Source File: 00000002.00000002.630373034.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5790000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 605f8ce2a475d43839a2456d24bb29771deaf127ab6b87c953940b4603319493
Instruction ID: caf3d3f42147dce6d402ad8b316b01ef30a6c699d74dabf6af76524eae195b1f
Opcode Fuzzy Hash: 605f8ce2a475d43839a2456d24bb29771deaf127ab6b87c953940b4603319493
Instruction Fuzzy Hash: 421115B19003598FCB14CF99D849BDFBBF4EB89324F10842AD529B7650C774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05795A48, Relevance: 1.5, APIs: 1, Instructions: 46registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(00000000), ref: 0579642F

Memory Dump Source

Source File: 00000002.00000002.630373034.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5790000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 848dca229103b257c0710dea3ae27b98f1a7ce4be8685df8fc9baf436f01ce27
Instruction ID: 3f650e44af29a385ffe2947d2f7eda78b1c988bd9b74b4aab79bfc154133e073
Opcode Fuzzy Hash: 848dca229103b257c0710dea3ae27b98f1a7ce4be8685df8fc9baf436f01ce27
Instruction Fuzzy Hash: E11103B19002598FCB10DF99D489BDEBBF4EB88324F10846AD529A7650C774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0161FE40, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0161FE9D

Memory Dump Source

Source File: 00000002.00000002.627584152.0000000001610000.00000040.00000001.sdmp, Offset: 01610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1610000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 61a057a35358863d2a2eab763acd83ca8252d80e069c8d9dbd20c7657475828c
Instruction ID: 6612c2b2bc64451f64865130b908404688521dfd54982fce87bf5e617b716225
Opcode Fuzzy Hash: 61a057a35358863d2a2eab763acd83ca8252d80e069c8d9dbd20c7657475828c
Instruction Fuzzy Hash: 6A1103B58002489FDB10CF99D985BDEBBF8EB88324F14845AD828A3340C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05790440, Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0579049D

Memory Dump Source

Source File: 00000002.00000002.630373034.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5790000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 5a72ef7385e76de1ffb9003f665cedeecfbf842530561be9c9ad0a0f6a94fa03
Instruction ID: 79df06f3a3a1ee7f94156d192245b6b9f879a2d475cb59c93cafc97bf865fb9b
Opcode Fuzzy Hash: 5a72ef7385e76de1ffb9003f665cedeecfbf842530561be9c9ad0a0f6a94fa03
Instruction Fuzzy Hash: 601100B1C006488FCB10CF9AD448BCEFBF4EB89324F10842AD429B3210C378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0159D3B4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627354712.000000000159D000.00000040.00000001.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_159d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724ec94dda8193c1a82dfbf1e0a0ccbbd113e9eeb144c8fe4f3ec54e7dbfa561
Instruction ID: dd53b7cd0daaac1b09f085bf5f75e6ce20bc4300ad2854f184d69ba6555925c0
Opcode Fuzzy Hash: 724ec94dda8193c1a82dfbf1e0a0ccbbd113e9eeb144c8fe4f3ec54e7dbfa561
Instruction Fuzzy Hash: 2521C1B1504244EFDF05DF54D9C0B6ABBB5FB88364F24C569E8090F246C376E856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0159D4A0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627354712.000000000159D000.00000040.00000001.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_159d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e835ab1a76074615d3471aed749230ae412bb14f72cdb5d6ab9a3de2bb877e0d
Instruction ID: 1df603c99ac60874cfa06d8255fdfd65992f9897917c10956a92000de2d21317
Opcode Fuzzy Hash: e835ab1a76074615d3471aed749230ae412bb14f72cdb5d6ab9a3de2bb877e0d
Instruction Fuzzy Hash: 592106B1504344DFDF05DF94D9C0B2ABFB5FB88368F248569D9090E246C376E855CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 015AD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627382110.00000000015AD000.00000040.00000001.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15ad000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65b64abcbaa5e0fe63b9d467560c77675c4969a3c82acd30dd29ea64d450780
Instruction ID: 469cf4f1cc845a5ed04953d6ea84050ca060201415df46f03531e5032abb985c
Opcode Fuzzy Hash: d65b64abcbaa5e0fe63b9d467560c77675c4969a3c82acd30dd29ea64d450780
Instruction Fuzzy Hash: E4213371584300DFCB10EF54D8C0B1ABBB1FB88354F60C969D8090F642D33BD806CA61

Uniqueness

Uniqueness Score: -1.00%

Function 015AD006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627382110.00000000015AD000.00000040.00000001.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15ad000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b7499a3de98546396d8a602ee9264796c01b1072a2cee8026bbaf325c55cc9b
Instruction ID: 127522f7f23aabb99b30453a450845b3034a9b36cae0aa52dcb9ab98918f4c1a
Opcode Fuzzy Hash: 3b7499a3de98546396d8a602ee9264796c01b1072a2cee8026bbaf325c55cc9b
Instruction Fuzzy Hash: 762192755493808FCB03CF24D990719BF71FB46214F28C5EAD8498F657C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0159D49B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627354712.000000000159D000.00000040.00000001.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_159d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02300354f26ebcfd8d1f5fee0bd3ff538f9c080a3beecbef12d4a17bc3822e08
Instruction ID: 357d6af1dde5dafcdbf886bcba53a008b7015863af721c93d2f5c5701087905a
Opcode Fuzzy Hash: 02300354f26ebcfd8d1f5fee0bd3ff538f9c080a3beecbef12d4a17bc3822e08
Instruction Fuzzy Hash: D111B176404280CFDF12CF54D9C4B1ABF71FB84324F28C6A9D9050B616C336D456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0159D3AF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627354712.000000000159D000.00000040.00000001.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_159d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02300354f26ebcfd8d1f5fee0bd3ff538f9c080a3beecbef12d4a17bc3822e08
Instruction ID: 2e1e3391851879b568760ec0585e97e32cc334215c74ab5af5b1a42da10d024f
Opcode Fuzzy Hash: 02300354f26ebcfd8d1f5fee0bd3ff538f9c080a3beecbef12d4a17bc3822e08
Instruction Fuzzy Hash: EB11AC76404280CFCF16CF54D9C4B5ABF71FB84324F28C6A9D8490B616C37AE45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384 Parent PID: 936 NEW PRICE ENQUIRY FROM PHILLIPINES.exeCOMMON

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	130
Total number of Limit Nodes:	9

Executed Functions

Function 04929828, Relevance: 1.7, APIs: 1, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04929A6E

Memory Dump Source

Source File: 00000005.00000002.409533024.0000000004920000.00000040.00000001.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4920000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7f642dcfcf3bdb88e248eb43343848268f577c8aedf1e8ca2a5a7ba3a145f4fb
Instruction ID: e6baa24633c689b163ebe0132de56852b4fd2dca1bc25debe0d820967efeddd0
Opcode Fuzzy Hash: 7f642dcfcf3bdb88e248eb43343848268f577c8aedf1e8ca2a5a7ba3a145f4fb
Instruction Fuzzy Hash: 987112B0A00B158FD724DF2AD14165ABBF5BF88314F008A2ED09ADBA54DB35F805CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0492569D, Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 04925759

Memory Dump Source

Source File: 00000005.00000002.409533024.0000000004920000.00000040.00000001.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4920000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a83048ab50193d9a14285b08d2c009aa07a610db0a15246f2a09bdc93c511b32
Instruction ID: f4cda7ccfdcb3865fa8f3f0fb3cff4ab4374d55161f1b0c6a8fde3dc4ea78c42
Opcode Fuzzy Hash: a83048ab50193d9a14285b08d2c009aa07a610db0a15246f2a09bdc93c511b32
Instruction Fuzzy Hash: 9E410570C00718DBDB24DFA9C9847DEBBF5BF88314F20806AD419AB255DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0492405C, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 04925759

Memory Dump Source

Source File: 00000005.00000002.409533024.0000000004920000.00000040.00000001.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4920000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8da7138678097fa5d8b776995057237674ff41a7f5dd2d9be6b7212c2c829e1f
Instruction ID: cf1ab5a7726b680eabc7d4c43d97827399817918aad5cebf725df01bb0495925
Opcode Fuzzy Hash: 8da7138678097fa5d8b776995057237674ff41a7f5dd2d9be6b7212c2c829e1f
Instruction Fuzzy Hash: 6841F170C00728CBDB24DFA9C944B9EBBB5BF88318F208069D419AB255DB716945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0492A514, Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0492BCFE,?,?,?,?,?), ref: 0492BDBF

Memory Dump Source

Source File: 00000005.00000002.409533024.0000000004920000.00000040.00000001.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4920000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 87dac2f731073dce83d2e16d9e09ff6914d5eb198f3e21e84959e2780b2d8753
Instruction ID: 1002bfa2b4580af0a99b2074840d0f8f55debe02dae7252e2c8bbeebf93c49e1
Opcode Fuzzy Hash: 87dac2f731073dce83d2e16d9e09ff6914d5eb198f3e21e84959e2780b2d8753
Instruction Fuzzy Hash: 812135B5D003189FDB10CF99D984AEEBBF4EB48324F14842AE854A3251D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0492A584, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0492BCFE,?,?,?,?,?), ref: 0492BDBF

Memory Dump Source

Source File: 00000005.00000002.409533024.0000000004920000.00000040.00000001.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4920000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d8de32c0847a6e77e3aba923dc8b2bfd6c17f0a5e2e7bbf7625036894aed2da0
Instruction ID: dbc936aaec665701b693cd3495cfef7547b92e1453b77f9802c5219c2da68644
Opcode Fuzzy Hash: d8de32c0847a6e77e3aba923dc8b2bfd6c17f0a5e2e7bbf7625036894aed2da0
Instruction Fuzzy Hash: A421E3B59003189FDB10CF99D984ADEBBF8EB48324F14842AE955A3350D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0492BD30, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0492BCFE,?,?,?,?,?), ref: 0492BDBF

Memory Dump Source

Source File: 00000005.00000002.409533024.0000000004920000.00000040.00000001.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4920000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2a301997dda4ba05a41f174a64c8a9d0772a3e40c622a0354753e378f3160be1
Instruction ID: ed65a8ec5a513e827dd2780d0e24f2d908d1bc9634f5326358f8f40c374eda7c
Opcode Fuzzy Hash: 2a301997dda4ba05a41f174a64c8a9d0772a3e40c622a0354753e378f3160be1
Instruction Fuzzy Hash: 022100B59002199FDB10CFA9D984ADEBBF4EB48324F14842AE824A3350D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04928B80, Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04929AE9,00000800,00000000,00000000), ref: 04929CFA

Memory Dump Source

Source File: 00000005.00000002.409533024.0000000004920000.00000040.00000001.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4920000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8e8562d4f3eb7604eb728e66f703d164e02dbe274efc1716f5daa409b538b798
Instruction ID: 12730c62975af711979196dcc5058ef937737175b919d4ff5a7c83376b504104
Opcode Fuzzy Hash: 8e8562d4f3eb7604eb728e66f703d164e02dbe274efc1716f5daa409b538b798
Instruction Fuzzy Hash: 4F1103B6E003199FDB10CF9AC544ADEBBF4EB88324F10842AE429B7240C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 066BDC74, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,066BEB91,?,?), ref: 066BED38

Memory Dump Source

Source File: 00000005.00000002.412540575.00000000066B0000.00000040.00000001.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_66b0000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 604a9317fa7893e353e1ab33e400f3aecd4624dbc10af98b443a0c78a20c6539
Instruction ID: cfa1c585f83ae91456bf22bd8f3e9c324e5e437a40d663e86d16bbd01a7febf2
Opcode Fuzzy Hash: 604a9317fa7893e353e1ab33e400f3aecd4624dbc10af98b443a0c78a20c6539
Instruction Fuzzy Hash: 651166B1800708CFDB50CF99C545BDEBBF4EB88364F10846AE864A7340C378A985CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 066BDCBC, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,066BEB91,?,?), ref: 066BED38

Memory Dump Source

Source File: 00000005.00000002.412540575.00000000066B0000.00000040.00000001.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_66b0000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ec82cf0d1399b20038f295c425397db33b1d509af3f973cdf51bf1d7cfe5fbe0
Instruction ID: 2a45838c42f1b24830d3be71b13447ad88540a9f1a2f4b4be2a89235eb66a99e
Opcode Fuzzy Hash: ec82cf0d1399b20038f295c425397db33b1d509af3f973cdf51bf1d7cfe5fbe0
Instruction Fuzzy Hash: 0E1155B1900708CFDB60CF99C545BDEBBF4EB88364F10842AE864A7340C378A985CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04929A08, Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04929A6E

Memory Dump Source

Source File: 00000005.00000002.409533024.0000000004920000.00000040.00000001.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4920000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 90474bf8d219968e6c3816ec9d1c6cd649b2e978b0aa46c0358eafc76f90d185
Instruction ID: d67a84347b1e6814b4404c25dc3d1bdc556b956d2229efdf27397ecf4925dafa
Opcode Fuzzy Hash: 90474bf8d219968e6c3816ec9d1c6cd649b2e978b0aa46c0358eafc76f90d185
Instruction Fuzzy Hash: 501110B2D003198FCB10CF9AC544BDEFBF8EB88324F10842AD429A7200C378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 066B2AD8, Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 066BD26D

Memory Dump Source

Source File: 00000005.00000002.412540575.00000000066B0000.00000040.00000001.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_66b0000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c0f2e5972bbbf5718a4b5524d297ef30f8f9b91c56e4c4afbbdfda4a7feaf929
Instruction ID: 34b9df9ef447bf65c2414d88157080be16aee15815cdc3ace4df3397f2f5f222
Opcode Fuzzy Hash: c0f2e5972bbbf5718a4b5524d297ef30f8f9b91c56e4c4afbbdfda4a7feaf929
Instruction Fuzzy Hash: AB11F2B5800348DFDB50DF99C989BDEBBF8EB48324F10842AE564B7240C375A994CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0087D4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.405431357.000000000087D000.00000040.00000001.sdmp, Offset: 0087D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_87d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d0025c9a8b6dd24738dfcabc81fdbdf3ab408c090bec9e1f17d021973fcd820
Instruction ID: b28e8ac5d82f84fae359e6293ad60f1937ad03e85a41801a2971503ae31bf27e
Opcode Fuzzy Hash: 5d0025c9a8b6dd24738dfcabc81fdbdf3ab408c090bec9e1f17d021973fcd820
Instruction Fuzzy Hash: EC21C1B1504344DFDB05DF14D9C0B26BB75FF88328F24C669E8099A24AC336E856DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0088D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.405471030.000000000088D000.00000040.00000001.sdmp, Offset: 0088D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_88d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf2252ab7e1fcdbe609601e073d2b34d4f4b84d022c783528b3c2ff7654140f
Instruction ID: 71884975427c1c2c7e35c954c3baa008f8b3b733733f3ec0245c3bd140b270e1
Opcode Fuzzy Hash: bdf2252ab7e1fcdbe609601e073d2b34d4f4b84d022c783528b3c2ff7654140f
Instruction Fuzzy Hash: B221D071604744EFDB14EF14D9C0B16BB65FB88328F24C569D8498B286C73AE846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0088D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.405471030.000000000088D000.00000040.00000001.sdmp, Offset: 0088D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_88d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4017d86090e99d55d8700fd5c5ff43d63948f2034b0a0ed84f60d891b0c9e98c
Instruction ID: d569e1da8432b53afa877e9a45521b23bb1145bedb615b0473faf7fb08697fb8
Opcode Fuzzy Hash: 4017d86090e99d55d8700fd5c5ff43d63948f2034b0a0ed84f60d891b0c9e98c
Instruction Fuzzy Hash: 1321F571504304EFDB05EF14D9C0B16BB65FB88318F24C66DD8098B2C1C73AE846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0087D4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.405431357.000000000087D000.00000040.00000001.sdmp, Offset: 0087D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_87d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02300354f26ebcfd8d1f5fee0bd3ff538f9c080a3beecbef12d4a17bc3822e08
Instruction ID: 226cab75ddb04ade4910590195aa6034caa9225724653b6d49ff87937e3210af
Opcode Fuzzy Hash: 02300354f26ebcfd8d1f5fee0bd3ff538f9c080a3beecbef12d4a17bc3822e08
Instruction Fuzzy Hash: B0118176504280DFCB15CF14D9C4B16BF71FF94328F28C6A9D8494B65AC336D856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0088D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.405471030.000000000088D000.00000040.00000001.sdmp, Offset: 0088D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_88d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6eb60a70ec0ca554554800ef63ac3af12c64d97730370158fb293fa66ec475
Instruction ID: 9c9bcf9439f67a8dfec6e1f46b2207f30c5e6154031950d6696f652d0aaba0f2
Opcode Fuzzy Hash: 3a6eb60a70ec0ca554554800ef63ac3af12c64d97730370158fb293fa66ec475
Instruction Fuzzy Hash: 9A118B75504284DFCB11DF14D6C4B15BBA1FB84324F28C6AED8498B696C33AE85ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0088D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.405471030.000000000088D000.00000040.00000001.sdmp, Offset: 0088D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_88d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6eb60a70ec0ca554554800ef63ac3af12c64d97730370158fb293fa66ec475
Instruction ID: 5d3ba42348ed41827e40e571d929f12c657277b7445e3cb2063e03f3ff09ab46
Opcode Fuzzy Hash: 3a6eb60a70ec0ca554554800ef63ac3af12c64d97730370158fb293fa66ec475
Instruction Fuzzy Hash: BD11BB75504780CFCB11DF10D5C4B15BBA1FB84324F28C6AAD8498B696C33AD84ACFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0087D731, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.405431357.000000000087D000.00000040.00000001.sdmp, Offset: 0087D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_87d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb0bf28b4b96d0420bfa6dcdc0bb96edb193cbbe05cb32faaacac610065e810
Instruction ID: 549178ba9eb792fc3091820397f8979c5f0e6a8f931957d9e4791761188f17c9
Opcode Fuzzy Hash: 0eb0bf28b4b96d0420bfa6dcdc0bb96edb193cbbe05cb32faaacac610065e810
Instruction Fuzzy Hash: 3B01FC314083449AE7148A25CCC4766BBE8FF513B8F18C429EC099B28AC778D840C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0087D730, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.405431357.000000000087D000.00000040.00000001.sdmp, Offset: 0087D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_87d000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57622019b42dede218485f263cc05c7c3fa4eaa6376957c45addd27f20ecc16b
Instruction ID: 8b6c88eb207a0df338aa72ec1990451243b63e0f2e745198fbf46c855c3c8c78
Opcode Fuzzy Hash: 57622019b42dede218485f263cc05c7c3fa4eaa6376957c45addd27f20ecc16b
Instruction Fuzzy Hash: 46F062714053449AEB148A15CCC4B66FBA8EF91778F28C56AED085B286C3799C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: dhcpmon.exe PID: 4800 Parent PID: 936 dhcpmon.exeCOMMON

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	116
Total number of Limit Nodes:	11

Executed Functions

Function 0133BB08, Relevance: 6.1, APIs: 4, Instructions: 122
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0133BB70
GetCurrentThread.KERNEL32 ref: 0133BBAD
GetCurrentProcess.KERNEL32 ref: 0133BBEA
GetCurrentThreadId.KERNEL32 ref: 0133BC43

Memory Dump Source

Source File: 00000008.00000002.414634029.0000000001330000.00000040.00000001.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1330000_dhcpmon.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8251c2c6a26e48f59e228b7dc74e5d5761080e62285b9cb60c77b61fe8fb9fab
Instruction ID: 91f4a2fe91cfde05c5c9494515bfa0ef95b0af416c7a3bf661e2eb316fb7c5c7
Opcode Fuzzy Hash: 8251c2c6a26e48f59e228b7dc74e5d5761080e62285b9cb60c77b61fe8fb9fab
Instruction Fuzzy Hash: 385157B4D00249CFDB14CFA9D948BDEBBF0EF88318F24856AE019A7350CB745945CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0133BB10, Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0133BB70
GetCurrentThread.KERNEL32 ref: 0133BBAD
GetCurrentProcess.KERNEL32 ref: 0133BBEA
GetCurrentThreadId.KERNEL32 ref: 0133BC43

Memory Dump Source

Source File: 00000008.00000002.414634029.0000000001330000.00000040.00000001.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1330000_dhcpmon.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cd94de2cb6d4c27d45e67af615a18c4c6b7e54cc1cde0f18667c769bb1495cba
Instruction ID: 387d5e2983ae8259a5352bc1dff0ca09c16ab873434b99bd179f32925cad92a5
Opcode Fuzzy Hash: cd94de2cb6d4c27d45e67af615a18c4c6b7e54cc1cde0f18667c769bb1495cba
Instruction Fuzzy Hash: C55157B4D002498FDB14CFAAD548BDEBBF0EF88318F24856AE019A7350CB746944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0133405C, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01335759

Memory Dump Source

Source File: 00000008.00000002.414634029.0000000001330000.00000040.00000001.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1330000_dhcpmon.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 99c0465e747a525dcb802b94f9ccc28dfa4946e1e9fcf34b9f33a673ecd02f4c
Instruction ID: 1f181914d6757430c5eec6c58f2c58c874895fa81c47cf7a694196f9807f8ad5
Opcode Fuzzy Hash: 99c0465e747a525dcb802b94f9ccc28dfa4946e1e9fcf34b9f33a673ecd02f4c
Instruction Fuzzy Hash: B841F3B0C0071DCBDB24DFA9C884B9EBBB5BF89308F248069D419AB251DB716945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 013356A0, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01335759

Memory Dump Source

Source File: 00000008.00000002.414634029.0000000001330000.00000040.00000001.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1330000_dhcpmon.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6a1a1374c301f7dad879f5613b7b537bfaef9499e36ec3b01f7cd65131e8d014
Instruction ID: f727ca25aeb9795b84d643f985348b0ab882c3bd0f048f114897a877d5552069
Opcode Fuzzy Hash: 6a1a1374c301f7dad879f5613b7b537bfaef9499e36ec3b01f7cd65131e8d014
Instruction Fuzzy Hash: 0041F271C00729CFDB24CFA9C884BDEBBB5BF89308F248169D419AB251DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0133BD37, Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0133BDBF

Memory Dump Source

Source File: 00000008.00000002.414634029.0000000001330000.00000040.00000001.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1330000_dhcpmon.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 242889a8a4141528d395a622206f596ad2e27d2530053ef7bff272e78a124f96
Instruction ID: 5e3db5212136e6ff86b263d2fddddb2338d7d806bc8d079398d2600229958f66
Opcode Fuzzy Hash: 242889a8a4141528d395a622206f596ad2e27d2530053ef7bff272e78a124f96
Instruction Fuzzy Hash: C221E0B59002589FDB10CFA9D884AEEBFF4EB48364F14842AE854A3350D378A955CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0133BD38, Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0133BDBF

Memory Dump Source

Source File: 00000008.00000002.414634029.0000000001330000.00000040.00000001.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1330000_dhcpmon.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 66865d0ca651d14654873e8c4fdc49727b18f1e84067254892007be46ffc8af7
Instruction ID: 28b16bdb60e1809182d1cdf63ed08748937dfebfd8af2c528e71e092194c7b69
Opcode Fuzzy Hash: 66865d0ca651d14654873e8c4fdc49727b18f1e84067254892007be46ffc8af7
Instruction Fuzzy Hash: 9321C2B59002589FDB10CFA9D884ADEFBF8EB48364F14842AE954A3350D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01338B80, Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,01339AE9,00000800,00000000,00000000), ref: 01339CFA

Memory Dump Source

Source File: 00000008.00000002.414634029.0000000001330000.00000040.00000001.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1330000_dhcpmon.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 751a5503dfb842f2139ac3dda7bc4b9ff5a6431d7dd22d3ab46cf4574c39e330
Instruction ID: 1ce1f8f5efd9ad4c5dcae18b7c933c206d44d018a74b8298d9fa339def307e53
Opcode Fuzzy Hash: 751a5503dfb842f2139ac3dda7bc4b9ff5a6431d7dd22d3ab46cf4574c39e330
Instruction Fuzzy Hash: 5411F4B69002099BDB14CF9AD444B9EBBF4EB88358F10842AD415A7600C3B4A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0753ECE0, Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0753ED38

Memory Dump Source

Source File: 00000008.00000002.419810952.0000000007530000.00000040.00000001.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7530000_dhcpmon.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: bfb666af342e84cb44f63df95177449f297bb0dff49a5a0628629f9af9d28111
Instruction ID: f2ff1fbeb2a59d7b23e069c56fc14de35d65cdb247ed9cd281f854bfd62b6dc4
Opcode Fuzzy Hash: bfb666af342e84cb44f63df95177449f297bb0dff49a5a0628629f9af9d28111
Instruction Fuzzy Hash: 811145B58003098FCB10CF99C485BDEBBF4EB48364F14882AD868A7740D778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07532AD8, Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0753D26D

Memory Dump Source

Source File: 00000008.00000002.419810952.0000000007530000.00000040.00000001.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7530000_dhcpmon.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 62c18eb9ac05b94cb8b47ccdf2711f29c4cc88e2a76cc7dce680fc7ecea3ea02
Instruction ID: a340ac9e1334aad8946f9bb66ac0dc6a2530dfcca695074b4bdcdb02a43e336a
Opcode Fuzzy Hash: 62c18eb9ac05b94cb8b47ccdf2711f29c4cc88e2a76cc7dce680fc7ecea3ea02
Instruction Fuzzy Hash: 5A1106B59003499FCB10DF99D485BDEBBF8FB49364F10842AE468B7600C3B5A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01339A08, Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01339A6E

Memory Dump Source

Source File: 00000008.00000002.414634029.0000000001330000.00000040.00000001.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1330000_dhcpmon.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7e30f2292b9a0b1a44b43c1958161dd9707e35ca77219919e7d959e475f3f0ef
Instruction ID: bec59567f24930129ab30b1f87bd18fd7625efb4f6a29dc9149c927423803fb9
Opcode Fuzzy Hash: 7e30f2292b9a0b1a44b43c1958161dd9707e35ca77219919e7d959e475f3f0ef
Instruction Fuzzy Hash: 271102B5C00219CFDB10CF9AC444BDEFBF4EB88328F10852AD469A7600C3B4A546CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01339A0A, Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01339A6E

Memory Dump Source

Source File: 00000008.00000002.414634029.0000000001330000.00000040.00000001.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1330000_dhcpmon.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: dd46c3522af8a811eb88a446db96e0e26b79c381bcf4057297efaaeeffcac8cf
Instruction ID: ece40117df7e0e8d82bd52e6d36d6b2a10ede9307d8ea2cda521ea7a2973195e
Opcode Fuzzy Hash: dd46c3522af8a811eb88a446db96e0e26b79c381bcf4057297efaaeeffcac8cf
Instruction Fuzzy Hash: 801102B5C00219CEDB10CF9AD444BDEBBF4EB88328F10852AD469A7600C3B4A546CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 053E8CEF, Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829658cb15da287a7149f1ac35ab679791fc63d952e97d700f6610b3c5cc267f
Instruction ID: b3a19ee6ec42e4a2f7af2aacf89ff5f8c518afa4a43f7c407b2fd3dd7572bf2b
Opcode Fuzzy Hash: 829658cb15da287a7149f1ac35ab679791fc63d952e97d700f6610b3c5cc267f
Instruction Fuzzy Hash: 62916F35B007018FDB04EF29D4947A9B7A2FF88304F558A79D80AAF396DF71A945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 053E7964, Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 992f10aaedff64c95b12cf1724eacbb96abc2aeafee2ba5255302ca28d0a38f5
Instruction ID: aa453f02a18bbc32364defad2b230fefe928f783b79569c01d8a21d39a509053
Opcode Fuzzy Hash: 992f10aaedff64c95b12cf1724eacbb96abc2aeafee2ba5255302ca28d0a38f5
Instruction Fuzzy Hash: 24916F35B007018BDB04EF29D4947A9B7B2FF88304F558A79E80AAF396DF71A945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 053EBE58, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 927953d61b4b7a3c2cf47c74f4486cbae91596ee350b6767b5377039bd5b8c39
Instruction ID: fd512c2bcfe4387da83e577062a0a4b95db36b73d28528aa716054ce472a2517
Opcode Fuzzy Hash: 927953d61b4b7a3c2cf47c74f4486cbae91596ee350b6767b5377039bd5b8c39
Instruction Fuzzy Hash: 93719F74A01219EFCB15DFA9D894DAEBBB6FF48224B114098F901AB361DB71EC81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 053EA6E0, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b31dfb846234e997ee9a762e031882b39be1512351ec8dc14e4ac578edd6bcf4
Instruction ID: 3d2d75b93b08e94633aaaebf29eabb5e638e8753f7ecefa655f37474404e896b
Opcode Fuzzy Hash: b31dfb846234e997ee9a762e031882b39be1512351ec8dc14e4ac578edd6bcf4
Instruction Fuzzy Hash: 1D51C331A04209CFCB15EBA4D8996AEBBF2FF85308F14852AD006E7390DF749D46DB91

Uniqueness

Uniqueness Score: -1.00%

Function 053E1AB0, Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 218f51a9554b33b19ab5f947f4ce34e26a1e19a951457737851a0608da2d696f
Instruction ID: 61d78ba870473c54a10ec4c6d92b9fae0fb8126fef1a9ed7a9453785a674c7f7
Opcode Fuzzy Hash: 218f51a9554b33b19ab5f947f4ce34e26a1e19a951457737851a0608da2d696f
Instruction Fuzzy Hash: 28519E35B05219CFCB25DBA9C4906EEB7F6FFC8214F54456AC10AE7680EBB4E901CB61

Uniqueness

Uniqueness Score: -1.00%

Function 053E249C, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c309fd83e680c8e38d95924c22c0b89c56d7ac8feb7cab0d5723ee2014978827
Instruction ID: c4b41f10ec148160daab6b038819cab4586d4b577463258bc21654b8c8686945
Opcode Fuzzy Hash: c309fd83e680c8e38d95924c22c0b89c56d7ac8feb7cab0d5723ee2014978827
Instruction Fuzzy Hash: 3951EF31B002594FCB21EB79CC4887EBBFAEFC5224B148569E019CB391EF70AD058B91

Uniqueness

Uniqueness Score: -1.00%

Function 053ED5A8, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2dccd124da4fa1d7d49370734ef93f2e12a5f2f139b00ef51d4ddbfb2047f4
Instruction ID: 02701984bafb5c5a06899ca17799dda91a205a322e44efaa4951fad089c3b7fb
Opcode Fuzzy Hash: 1a2dccd124da4fa1d7d49370734ef93f2e12a5f2f139b00ef51d4ddbfb2047f4
Instruction Fuzzy Hash: AB51B131A046198FCB18EF78D4544AEBBF2FF85318720866DD41A9B391DB35AD42CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 053ECE81, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 176f179536e02b69e67fcf3e7174b909fec8638b895916c0da4464e16f855975
Instruction ID: 84df80a3ae502137872a34d9393b74f19e8c256d284ab3f7db647445335c6c48
Opcode Fuzzy Hash: 176f179536e02b69e67fcf3e7174b909fec8638b895916c0da4464e16f855975
Instruction Fuzzy Hash: 2A51F935A106198FCB04EF68C89899DB7F5FF89704B1585A9E506EB371EB70AC45CB40

Uniqueness

Uniqueness Score: -1.00%

Function 053ECE90, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52100d79a349f7d9938c587d38ece7a095a406c95362a248eec79e67031606e8
Instruction ID: 4e20d7564b907c3b49cebd961c9e0bf17dab9835d57e12d4661912240c66c8de
Opcode Fuzzy Hash: 52100d79a349f7d9938c587d38ece7a095a406c95362a248eec79e67031606e8
Instruction Fuzzy Hash: 4051E634A10619CFCB04EF68C8989ADBBF5FF89704B1585A9E506EB371EB71AC45CB40

Uniqueness

Uniqueness Score: -1.00%

Function 053E00C4, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c3868048e054912312ab46b789fa90189d02ac1e71ca91ceec087ca454eb4c6
Instruction ID: 9256b04a3fc5714d8e63669a826d9403999d5a659ad7d3e25cbbcc5dce33e61a
Opcode Fuzzy Hash: 0c3868048e054912312ab46b789fa90189d02ac1e71ca91ceec087ca454eb4c6
Instruction Fuzzy Hash: 63319030E12219DFCB18EFA0E548AADBBB2FF84310F118569E44277691CB709966CF50

Uniqueness

Uniqueness Score: -1.00%

Function 053EC2A0, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 994a3fb69cb119b06d366668a515fbfc7e527f9fdf6eee33b75fe60b8727bc1b
Instruction ID: 48d8fedded15b1a75ea7af3f3f1ef951f0df2d2775f62e9f362a24cec4468707
Opcode Fuzzy Hash: 994a3fb69cb119b06d366668a515fbfc7e527f9fdf6eee33b75fe60b8727bc1b
Instruction Fuzzy Hash: 5E415A30B142688FDB14DBA9C894EADBBF6FF89604F1450A9E501EB3A1CB75EC00CB51

Uniqueness

Uniqueness Score: -1.00%

Function 053EA200, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f285d5a7e99d37bc51183c3a806cfd0379c3d3e12b02f827b176f1242bbe43ce
Instruction ID: d3987c814ac9fe7336d9e09b9b250557d55cf5fb384fb980064230bd2e0aa518
Opcode Fuzzy Hash: f285d5a7e99d37bc51183c3a806cfd0379c3d3e12b02f827b176f1242bbe43ce
Instruction Fuzzy Hash: 45516E30A00209CFCB15EFA8C595A9DB7F1EF89304F5488ADE406AB3A1DB75AD05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 053EAD38, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c62a4c1d51d800c3643790c450a98a68e15ebc15bdb5f2b06e6a8c06379daf
Instruction ID: 08e032ad397175330f885482cee6edab450a4b1c54fd5c1e84a720fe410d1134
Opcode Fuzzy Hash: 67c62a4c1d51d800c3643790c450a98a68e15ebc15bdb5f2b06e6a8c06379daf
Instruction Fuzzy Hash: CB510B75A01219AFDB14DF94D598BEEBBF2FF88310F108459E905A73A0CB71AD41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 053E2110, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c5a3eed4c6d2ce464872af8e3be794fea1a81883d6c49150093a4877f6e927e
Instruction ID: aac2051318150bc46b97b4c9399150e4561c09032da4608ad87d0d7f0614d545
Opcode Fuzzy Hash: 1c5a3eed4c6d2ce464872af8e3be794fea1a81883d6c49150093a4877f6e927e
Instruction Fuzzy Hash: 35412331B042188BCF06DBA4C850AEF7BBAEFC9308F114569E505AB391DF79AD05C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 053EA4B8, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9211dfac61316ea8dbef241dc2c18df47eb961d3ed978cac8cb7d8fd66d1fab8
Instruction ID: f7a96320f934f48da0d39ee37c211d2ef51d117c4626b910fb566876f6d94b23
Opcode Fuzzy Hash: 9211dfac61316ea8dbef241dc2c18df47eb961d3ed978cac8cb7d8fd66d1fab8
Instruction Fuzzy Hash: 5341FB35A042298FDF14EBA8C898B9DB7F1FF89314F114058E505AB3A1DB79A801CF60

Uniqueness

Uniqueness Score: -1.00%

Function 053EA228, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab5f21f3e38307c4cf9649a97115e55827ba83e68f3acd18b6bf4acd526f565
Instruction ID: 047543f355909d90fc853a4c4653ca9fde9ee3721a82029148d3d81e34c263c6
Opcode Fuzzy Hash: aab5f21f3e38307c4cf9649a97115e55827ba83e68f3acd18b6bf4acd526f565
Instruction Fuzzy Hash: B8415F30A00209CFCB14EFA8D59499DB7F2FF89308F508969E416AB3A1DBB5AD05CF50

Uniqueness

Uniqueness Score: -1.00%

Function 053ED780, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f62762742bc69aa4eb2518789f359718a13174dfaac66214ea845ac3af644c9
Instruction ID: bcda3f489a04220c3833b77512e16b170ecdb1640630eec7d3deade9521b9644
Opcode Fuzzy Hash: 4f62762742bc69aa4eb2518789f359718a13174dfaac66214ea845ac3af644c9
Instruction Fuzzy Hash: 70411A31B112299FCB1ADBB9D8846EEB7F2BF48204F14492DE116A7390DB749D41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 053E8BA0, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18c806cae3508f4cdd910049ea244cdf1c54b710b5977fe63d90b91e2a8eb05
Instruction ID: 786199a4e733bb4cdec8e211d4c2fa80bb69cf2bdbcb1c10f58397e958e95de2
Opcode Fuzzy Hash: b18c806cae3508f4cdd910049ea244cdf1c54b710b5977fe63d90b91e2a8eb05
Instruction Fuzzy Hash: C731D430B042250FE718E778D4657AEB7E6DFC5714F1481B9E41AAB3E1CE749D028792

Uniqueness

Uniqueness Score: -1.00%

Function 053EEA80, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88ed0ccc3502a8d58d7ee44d2482fee8541f4c6092b90e5857e578fa57c43f4
Instruction ID: 8490498c1bc0631389ebbe8b18444e6ade02e84dc46a1079e92103c3f684c958
Opcode Fuzzy Hash: e88ed0ccc3502a8d58d7ee44d2482fee8541f4c6092b90e5857e578fa57c43f4
Instruction Fuzzy Hash: 1841E675A0020A9FCB40DF68D884A9EFBF5FF49314B14C699E919AB311E770E949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 053E2106, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79df6c33ca3677f8a6587dfbf91a1bac20993576576a70973ed5ddd39fbd20d2
Instruction ID: c85c3b315c776845b16b1478934133ba57ad194429a7135a3ee2d9bbe8e37ffd
Opcode Fuzzy Hash: 79df6c33ca3677f8a6587dfbf91a1bac20993576576a70973ed5ddd39fbd20d2
Instruction Fuzzy Hash: 30313436A042299BCB05DBA4C850ADFBBFAAF88304F014569E505BB381EB75AD45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 053E26E0, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42205183ef0fb2d294123458b1358128a46b1af7757977fddcf02171cbad5958
Instruction ID: 6feb2f52eafd07bbc053a79f918c39aace83a3ea4cfe212ca02b24f9a6bd2b4e
Opcode Fuzzy Hash: 42205183ef0fb2d294123458b1358128a46b1af7757977fddcf02171cbad5958
Instruction Fuzzy Hash: 8F312436A042289BCB05DBA4C840ADFBBFAEF88304F014579E505BB381EB75AD05C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 053ECAB0, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb5971797acd4934a0e9ba75ff171f1fb222ee318ebc158102412586f0e087a
Instruction ID: 1f37e2c75e4f6fd5feb69d65e3fee26b472a54cc7c94bb7ff5aaf5b62b1f927d
Opcode Fuzzy Hash: feb5971797acd4934a0e9ba75ff171f1fb222ee318ebc158102412586f0e087a
Instruction Fuzzy Hash: 3C318071E047118BDB04EF79D48475577B6FF84314F498E79DC096B286EB30A894CB61

Uniqueness

Uniqueness Score: -1.00%

Function 053EEA90, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e95ae1ff78fb0e1f76528e5e80c5c8af17cea713ee34c7bff4366bda918262
Instruction ID: 8cf3504dab2afe0123eb25dadef6d9fbde713f5ca4dc6a4b7bf8aa25e3de102a
Opcode Fuzzy Hash: a9e95ae1ff78fb0e1f76528e5e80c5c8af17cea713ee34c7bff4366bda918262
Instruction Fuzzy Hash: F141F675A0020A9FCB40DF68D88499EFBF5FF49314B14C699E918AB311E770A949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 053EDBD0, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 795c34996dabacfd19990d97f35ee89173eb6f3d72ea358321df2265f3be7e14
Instruction ID: 7cbdf567b450145c27ed0e994378919060edcd61406138b775008abde3c7fc00
Opcode Fuzzy Hash: 795c34996dabacfd19990d97f35ee89173eb6f3d72ea358321df2265f3be7e14
Instruction Fuzzy Hash: E9319071E047118BDB04EF79D48479677B6FF84314F598A7ADC0A6B386DB30A894CB60

Uniqueness

Uniqueness Score: -1.00%

Function 053ED76F, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea4bf708248618d47bc33bf33ad5bfd18dc6c30676472350d813dd070fb08e2a
Instruction ID: d0e4c0843f15bc199a960ce6dbe488716373b22aa21ce3d9ae0aab8cfac33d60
Opcode Fuzzy Hash: ea4bf708248618d47bc33bf33ad5bfd18dc6c30676472350d813dd070fb08e2a
Instruction Fuzzy Hash: 2431AE31B012299FCB16DAB9D4947EEB7F6BF48300F00492EE516A7390EB70A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 053EC326, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f92d59e6a00a6240bc8636abdf3297497fdae3e8381c8091cc233dab56f89d06
Instruction ID: ec13206a0e38476bf16d8dd717231da54095c9346a9d15e44bdba0004328c581
Opcode Fuzzy Hash: f92d59e6a00a6240bc8636abdf3297497fdae3e8381c8091cc233dab56f89d06
Instruction Fuzzy Hash: 6E3116357142288FDB10DBA9C494EACBBF6BF49705F5410A9E501DB3A2CBB5DC01CB11

Uniqueness

Uniqueness Score: -1.00%

Function 053EC5B9, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c4d5ea8ca8623b402b63fa96754838f3b3cccc9f51e3fe39553ed520bd7d29a
Instruction ID: 3b37dc66232aee508989bc1f3cc4f965694e4223d171d87cf5d8da6108790053
Opcode Fuzzy Hash: 8c4d5ea8ca8623b402b63fa96754838f3b3cccc9f51e3fe39553ed520bd7d29a
Instruction Fuzzy Hash: 6E21F6353105248FCB58EB2DD898D6E7BE6FF89A1572600A9E506CB3B5DA71DC028B90

Uniqueness

Uniqueness Score: -1.00%

Function 053E9440, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b68e6a65ed6faaefe37c482515d6cf8c44f7f18041e067511172cbeb436585
Instruction ID: bec135a118b4e5970bf6dc7ce6fd027d4de5e3a370da6b30ad822933a0af22c9
Opcode Fuzzy Hash: e4b68e6a65ed6faaefe37c482515d6cf8c44f7f18041e067511172cbeb436585
Instruction Fuzzy Hash: BE311232D00B099ECB01AFB8C8544D9F771FF95304B119B5AE95967221FB30E695CB81

Uniqueness

Uniqueness Score: -1.00%

Function 053EAD29, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abab63b0fc22eef0793263e80a876904ef6afee0afb153f4e018d02e657b9531
Instruction ID: 7066c4c4eb798f36d1119f86b021bf19988c515878f1fa249b9f87a63179e0b8
Opcode Fuzzy Hash: abab63b0fc22eef0793263e80a876904ef6afee0afb153f4e018d02e657b9531
Instruction Fuzzy Hash: 6E313674A012199FDB10CF54D595BAEBBF2BF48310F158468E905B7790CB71AD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.413653691.0000000000F9D000.00000040.00000001.sdmp, Offset: 00F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_f9d000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7beaeaaa95fc1d642fef42cefac2ae59e7888bcce526a07d5c9f359d66f3f2ab
Instruction ID: b643049826a806c2e5916a839fbf1a0ce7d6637880963d90adaeb801adead442
Opcode Fuzzy Hash: 7beaeaaa95fc1d642fef42cefac2ae59e7888bcce526a07d5c9f359d66f3f2ab
Instruction Fuzzy Hash: CF21F5B2904344DFEF15DF14D9C0B26BF65FB88368F388569E8050B246C336E856EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 053E21A0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e026b14357d4b0474ac72c0eae8c2b9bee9ba694c969be546cfbe04c74904fd
Instruction ID: 8d655eda568cb142d41da3cdecfd04f3ea3e78a62e3924d90149ed6029a29646
Opcode Fuzzy Hash: 4e026b14357d4b0474ac72c0eae8c2b9bee9ba694c969be546cfbe04c74904fd
Instruction Fuzzy Hash: E3210175B102148FCB08EB78C8559AEBBFAEF89210F0944A9E505EB390CF719C41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 053E9450, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a20453e5b2dc0e54597a01991087b5dd41181d6e8b7cf5c7b9f718e0fa4d70c5
Instruction ID: d39449ea361595c3b9ef95b415e139762da0b4c2fa8f13afdd39bd43b4f77a77
Opcode Fuzzy Hash: a20453e5b2dc0e54597a01991087b5dd41181d6e8b7cf5c7b9f718e0fa4d70c5
Instruction Fuzzy Hash: 4D310332D10B0EDECB01EFA8C854499F7B1FF95304B118B5AE95967121FB30E695CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FAD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.413724672.0000000000FAD000.00000040.00000001.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fad000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded5b340f2719124af09c08271fdd11815233a13abf51ce75ccef675b1e4ce9b
Instruction ID: 6ca2cdfdff14c3ef64da23f81b27e1e640c61cd1f2bd18773cc63742c454fea7
Opcode Fuzzy Hash: ded5b340f2719124af09c08271fdd11815233a13abf51ce75ccef675b1e4ce9b
Instruction Fuzzy Hash: 3D2122B2A04300DFCB14DF20D9C0B16BB61FB89328F24C569D80A4B68AC73BD846DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00FAD1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.413724672.0000000000FAD000.00000040.00000001.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fad000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c55f37ce85ab23f54f0e6c905e7c7b38fa42c476209625a65b4840a74539b9
Instruction ID: e1e53ab15dae632bd5b4d824b1897b30f161c297b14629d11ef067cb66cb4952
Opcode Fuzzy Hash: 44c55f37ce85ab23f54f0e6c905e7c7b38fa42c476209625a65b4840a74539b9
Instruction Fuzzy Hash: 102107B1904304EFDB05DF10D9C0B26BBA5FB89328F24C57DD80A4B681C73AE846DB61

Uniqueness

Uniqueness Score: -1.00%

Function 053ED498, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b26f7a2830a43e501cef8c420b10cb7fb473f5f498c77521f21969a760de260f
Instruction ID: 8755952eb2b266a9a56cec7ea040b41c94a416cefba74fcd68cbe9f554a4bc0c
Opcode Fuzzy Hash: b26f7a2830a43e501cef8c420b10cb7fb473f5f498c77521f21969a760de260f
Instruction Fuzzy Hash: E521CC303146208FCB54EB3DD454A29B3E6AF85619B15896DE506CF3A5DFB1EC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 053ED488, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5797224fa8039e6f7be421f35d8218bd32916a5f3ec2af5c0165b0d96385f8f0
Instruction ID: c234732896c01b9ad1cfe5e19c5dcf2482863ccdae6a15233a3221cd9a67558e
Opcode Fuzzy Hash: 5797224fa8039e6f7be421f35d8218bd32916a5f3ec2af5c0165b0d96385f8f0
Instruction Fuzzy Hash: 79214C303046208FCB19DB38D454A2977E6BF9661971588AEE506CF3B1DFB2EC02CB50

Uniqueness

Uniqueness Score: -1.00%

Function 053ED1C0, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b54d49cc3d7b7312bb5fc1bb8fbb1b5842790ef95654721ab7e26ab33ea82460
Instruction ID: 3ccaade219d2f3c5e4d43952968d8d181df10d49cf10ba71c2ff53ab15e04796
Opcode Fuzzy Hash: b54d49cc3d7b7312bb5fc1bb8fbb1b5842790ef95654721ab7e26ab33ea82460
Instruction Fuzzy Hash: 20117531F0062A8BDB10EAA994416BEF7F6FFC4610F14892ED515A7280DB74D90147D1

Uniqueness

Uniqueness Score: -1.00%

Function 053E263C, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16dd70ab2cd9487422a221f354a2b91501d5ba73dff820dd1c009b88ebb03e56
Instruction ID: 35dfce0ee53577fa86f375cfe616168464764cb2d6647c588f1fb337ef68a057
Opcode Fuzzy Hash: 16dd70ab2cd9487422a221f354a2b91501d5ba73dff820dd1c009b88ebb03e56
Instruction Fuzzy Hash: 1531C0B0D012589FDB20CF99C988B8EBBF5EB48354F24802AE405BB290C7B55845CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 053E71AC, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b172c05194a271ca989b913795800a58c13005fd612242d9833a857941c3635b
Instruction ID: 05c4c12216b00d6869f2a7932b538bd54e3eeadd046be5a1a8a2885a361775e2
Opcode Fuzzy Hash: b172c05194a271ca989b913795800a58c13005fd612242d9833a857941c3635b
Instruction Fuzzy Hash: 1031C0B1C012589FDB20CF99C989BCEBBF4FB48354F24802AE404BB280D7B55985CF95

Uniqueness

Uniqueness Score: -1.00%

Function 053ED1B0, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edf0265b20ebc1c11e8eac1c0d26ce971e358c67ec2f052e64a7eaa61cabbaf7
Instruction ID: 848e14c724c4275ca4e46407e977068e13b9e0bf184c796f6da02af56fc28049
Opcode Fuzzy Hash: edf0265b20ebc1c11e8eac1c0d26ce971e358c67ec2f052e64a7eaa61cabbaf7
Instruction Fuzzy Hash: 1911B232B006264BDB20AEA998417AFB7F6FBC4610F04492AD515E7280D674D90247D0

Uniqueness

Uniqueness Score: -1.00%

Function 053E248F, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87cbddac2ae8a956ad01fdebc86bc52f4ae6d4900d31d3a24a7b5bb54ea6cff
Instruction ID: dd662a09fb0a43c913e44c3e998f42b4d4f8b74df3a7f5ac73991a0c49df0550
Opcode Fuzzy Hash: e87cbddac2ae8a956ad01fdebc86bc52f4ae6d4900d31d3a24a7b5bb54ea6cff
Instruction Fuzzy Hash: 5111C876B002554B8B25DB798C4457FBBFBFFC42607148A29E419D7380DF709D058761

Uniqueness

Uniqueness Score: -1.00%

Function 00FAD005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.413724672.0000000000FAD000.00000040.00000001.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fad000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2d55aeed172376a34f2eadabac28623e051671cd425b58162556c51a656d3b2
Instruction ID: 50c7eab7d57f43131c0c0cd3d60d59df29a16a456fab1a71fab7074159865f36
Opcode Fuzzy Hash: f2d55aeed172376a34f2eadabac28623e051671cd425b58162556c51a656d3b2
Instruction Fuzzy Hash: 6C2150755093C08FCB12CF24D994715BF71EB46324F28C5EAD8498B697C33A984ADB62

Uniqueness

Uniqueness Score: -1.00%

Function 053E21C8, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15db77855a5cca08a4e28c08fa7940a01eeef92f48910bbe960067400e00113e
Instruction ID: b0e8a06cdcf9cf32a53788927dbf5c2e353b6843491ca7663bceff8ad735afd5
Opcode Fuzzy Hash: 15db77855a5cca08a4e28c08fa7940a01eeef92f48910bbe960067400e00113e
Instruction Fuzzy Hash: 0811DD74B102149FC709EB38C4589AEBBFAEF89210F0984ADE402AB391CA719C45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 053E20F4, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38fb2ec5a5b71cbd5a839a4e7785748d9ada1f056c577d77bc282813e83900b5
Instruction ID: e7ea88a5f292dbfa60da2230f61c4de4e0aa28deafc9a1932121c0b72a5800c3
Opcode Fuzzy Hash: 38fb2ec5a5b71cbd5a839a4e7785748d9ada1f056c577d77bc282813e83900b5
Instruction Fuzzy Hash: 9411E274B14215CFCB05FB24C85896FBFFAEF49210F1548AAE401AB392CA35DC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 053E6FF7, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90a703b149ab856280a68e2b483078edda69d0d31ab034ca7e4bb54395134c6
Instruction ID: 322b3e9046cb35e5e81b7ea1e12cc25e44638a9c215a21b8503b0a3bcc53d0c1
Opcode Fuzzy Hash: e90a703b149ab856280a68e2b483078edda69d0d31ab034ca7e4bb54395134c6
Instruction Fuzzy Hash: B511C176A003554F8B22EA798C449BFBBFBFFC52607148529E459D7380EF709D068761

Uniqueness

Uniqueness Score: -1.00%

Function 053ECA80, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16afc0d8df4bd7d66d7f8df366d12000ac651c166ef3bf49af07f9ab4a05da3
Instruction ID: bb733cac9ff7287513869ab8b0e7c6e18ae532257fe7c33931534c19abacac54
Opcode Fuzzy Hash: c16afc0d8df4bd7d66d7f8df366d12000ac651c166ef3bf49af07f9ab4a05da3
Instruction Fuzzy Hash: 10214931A10719CFC728EB78C554BAAB3F3FF85305F00496DD16A5B2A1DB71AA41CB81

Uniqueness

Uniqueness Score: -1.00%

Function 053EDAF8, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80fb1b407bb01a846f5bdd552aa4aa5370afd09db438e3325f3039936908985
Instruction ID: 3f92c2556141ab94a87ca598c97e24248af7a627cf56e50620c450c459eb0bb5
Opcode Fuzzy Hash: b80fb1b407bb01a846f5bdd552aa4aa5370afd09db438e3325f3039936908985
Instruction Fuzzy Hash: BE217C31A10719CFC728EB78C555BEAB3F3BF84305F00486DC16A5B2A1DB71A982CB81

Uniqueness

Uniqueness Score: -1.00%

Function 053E6F28, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd35b118417f359e1782a26eb2d4010bb2ade4a205f484f8c122f00a15870ef
Instruction ID: c7fc6cee23e3f019d79b3e95c354039b1d6ec32433128f4cf7fc645625a86829
Opcode Fuzzy Hash: 8cd35b118417f359e1782a26eb2d4010bb2ade4a205f484f8c122f00a15870ef
Instruction Fuzzy Hash: 44117735B002298F8B14EBF895116FEB7FAAF99254B100479D505EB380EF329D528BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.413653691.0000000000F9D000.00000040.00000001.sdmp, Offset: 00F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_f9d000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02300354f26ebcfd8d1f5fee0bd3ff538f9c080a3beecbef12d4a17bc3822e08
Instruction ID: 9879b02f142e362fd6c1f8b91669c1f11814ef167cbd5753abdc22663c4bd6a0
Opcode Fuzzy Hash: 02300354f26ebcfd8d1f5fee0bd3ff538f9c080a3beecbef12d4a17bc3822e08
Instruction Fuzzy Hash: 2511AF76804280CFDF15CF10D9C4B16BF71FB84328F3886A9D8454B616C336D856DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 053EC520, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6904298ebdd5f367e0ed44856736634a372d108b48779024db035e5d908df57c
Instruction ID: 8b76c841d529a9d15068afbf9e003f37a8cbbd4b2b983738c3f6477d1b8f9087
Opcode Fuzzy Hash: 6904298ebdd5f367e0ed44856736634a372d108b48779024db035e5d908df57c
Instruction Fuzzy Hash: 47117C71F0061A9BCB14DBA9D91A7BEBBF2FF88210F144469D515E3380DB74AE028BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00FAD1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.413724672.0000000000FAD000.00000040.00000001.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fad000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6eb60a70ec0ca554554800ef63ac3af12c64d97730370158fb293fa66ec475
Instruction ID: fa9fefef5029f648ef51254b330cf383d9a9c75425e1c16c522713ca49f0089d
Opcode Fuzzy Hash: 3a6eb60a70ec0ca554554800ef63ac3af12c64d97730370158fb293fa66ec475
Instruction Fuzzy Hash: D6118EB5904280DFCB15CF10D9C4B15BBB1FB85324F24C6ADD8494B656C33AD85ADB51

Uniqueness

Uniqueness Score: -1.00%

Function 053ECD49, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec58fea393076550aac2264368335207db989549180c6c2ac008609a6353822
Instruction ID: dd03e9a7e4dac333c83baff7d7829e387cac4b63afdcbefb1f5b6fd651bcaa51
Opcode Fuzzy Hash: 1ec58fea393076550aac2264368335207db989549180c6c2ac008609a6353822
Instruction Fuzzy Hash: BB01A7723046345BD324DA6EEC41B9BB7DDEFC4664704453AE90DC7750E671EC418694

Uniqueness

Uniqueness Score: -1.00%

Function 053E6E40, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba782c0b867828381cb49d5468e275ecb7b970d7f765478b957c99c349ae438
Instruction ID: 76b0f0daf20169410e2823600808bf87e633c25cf5dcc45a4109e4237b092b4c
Opcode Fuzzy Hash: 8ba782c0b867828381cb49d5468e275ecb7b970d7f765478b957c99c349ae438
Instruction Fuzzy Hash: 3701F9767401081FD714D6799CA1B6A628BDBC8214F254138E10ADF7D4DE20AC4252A2

Uniqueness

Uniqueness Score: -1.00%

Function 053EC530, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe50a876716ebbf9cd93e5e8cffd82f5dc20c0e195efc3d6adf62b1b97138f3d
Instruction ID: c1c3717fa285737d440ebc28839f741eafb1385f3c7fbd01d829c036a45e5a14
Opcode Fuzzy Hash: fe50a876716ebbf9cd93e5e8cffd82f5dc20c0e195efc3d6adf62b1b97138f3d
Instruction Fuzzy Hash: A9015B71F0051A9BCB14DF99D919ABEBBF6FF88210F044469D519E3380DB74AA028FD5

Uniqueness

Uniqueness Score: -1.00%

Function 053E1668, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e4d92f7793255862f4c2af1130c2b728387c783681017b26b9a76ef9ef60056
Instruction ID: f11de8a0d895b7e20b50eacdbc22c42219f430b9b7cd5dc16026af856496927b
Opcode Fuzzy Hash: 4e4d92f7793255862f4c2af1130c2b728387c783681017b26b9a76ef9ef60056
Instruction Fuzzy Hash: 031125B5900218CFCB10DFA9D445BDEBBF8EB48364F14842AD819A7740D774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 053E6E50, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c233d3d33fb948df9d75a13b7177edf9dc18a5caecf20f7883cc9a299e920a83
Instruction ID: c17bd43f1394674a4b1f8d44c26373f6639d2765fbe09df9df18b317f96e0d90
Opcode Fuzzy Hash: c233d3d33fb948df9d75a13b7177edf9dc18a5caecf20f7883cc9a299e920a83
Instruction Fuzzy Hash: 29F0C8317442081FD328E67A9CA0F6B719BDBC9754F244138A10ACF3D5DE60AC4142A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D731, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.413653691.0000000000F9D000.00000040.00000001.sdmp, Offset: 00F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_f9d000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3173860006e769813601b50758a8571f096879cf53bce9d8c2f81c26188f9b64
Instruction ID: 15a9690db71ae451f349489586994e1b00c3e76fb89fcbec4cd83b0a5892b74c
Opcode Fuzzy Hash: 3173860006e769813601b50758a8571f096879cf53bce9d8c2f81c26188f9b64
Instruction Fuzzy Hash: 2801F7728083449AFF108A65CDC4B66BBD8EF453B8F38C42AED041A686D7789840D6B3

Uniqueness

Uniqueness Score: -1.00%

Function 053E1670, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e71a1258e3fe6e7ad2a99dd7e6ab0138e5820411d4033d612870f2e2dad222d7
Instruction ID: 6a298c7b18bc005245e465faf72acf2ddc7475f6e3103900a7c5b1af91ab00c9
Opcode Fuzzy Hash: e71a1258e3fe6e7ad2a99dd7e6ab0138e5820411d4033d612870f2e2dad222d7
Instruction Fuzzy Hash: 8C1103B59002188FCB10DF99D484BDEBBF4EB49364F14842AD869A7740D778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 053ED121, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d9fd5461fa92c148d8a921b7c2c87348e409e96bfd65865c5ced8df566ad10
Instruction ID: ed2f9d1250240a2cdefaa0a725c3daf874a3984053742e8c475032be65c49c9e
Opcode Fuzzy Hash: c5d9fd5461fa92c148d8a921b7c2c87348e409e96bfd65865c5ced8df566ad10
Instruction Fuzzy Hash: 870131357511148FD704DB2DD858FAA77E9EFC8A25F1981BAE509C7361DE60DC018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 053E08BB, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ae89bfa9753d47a901cbe34a86a6c94cee8659ed6cfb3ac54d1f6c2f7b5377
Instruction ID: 1d19ab2dd82ecced58ea29cbb978e2bf0d8d596934bd1e33b21d0013f90240ea
Opcode Fuzzy Hash: 17ae89bfa9753d47a901cbe34a86a6c94cee8659ed6cfb3ac54d1f6c2f7b5377
Instruction Fuzzy Hash: 81F09C75B001299B8F1AA6A45C985BEBBF6EBC4520B100029E605A73C0DE754D11C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 053EE9E0, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc2efc2f484d79e16389575bbe456ebe32ad9bfdc82043f379505b972d128de9
Instruction ID: 19c8d6c1270d228c9b21a3b8227aae9f00eace389f990b6f6cf2799f633c3b0c
Opcode Fuzzy Hash: cc2efc2f484d79e16389575bbe456ebe32ad9bfdc82043f379505b972d128de9
Instruction Fuzzy Hash: 9401C8719102199FCB40EFACC5459DEBBF4FF49210F10859BE458E7321EB709A408B91

Uniqueness

Uniqueness Score: -1.00%

Function 053E08C0, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f979234e6c13c0aa558e7bd20ddbad8f0975530a7077ebfc272902dba480541e
Instruction ID: ce0fa288b964a971a40cb52af49ea3b911d44c06419222998246fd53e892e2ca
Opcode Fuzzy Hash: f979234e6c13c0aa558e7bd20ddbad8f0975530a7077ebfc272902dba480541e
Instruction Fuzzy Hash: 68F05B75B001299B8F1EB7A55C985BEBBFAEBC8620B100029E615A73C0DE754E11C7E6

Uniqueness

Uniqueness Score: -1.00%

Function 053E7608, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37313db965700c3fdb0f4b0b9fa267bf9e81499c182835cbf4851ce6d1d9d50
Instruction ID: a82b78f0ba9157401e3c07e83d5132d461476387e6314d73f5b1b155939ee561
Opcode Fuzzy Hash: b37313db965700c3fdb0f4b0b9fa267bf9e81499c182835cbf4851ce6d1d9d50
Instruction Fuzzy Hash: 01F05E7A7001285FD314D75EEC95DA7BBE9EFC82747544036F508D7311DA309D0486B0

Uniqueness

Uniqueness Score: -1.00%

Function 053E756C, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 236bc0f4d8ae6d876ebc504a913f47c0fcaf4430aad8bc8c565e490f5cc901d8
Instruction ID: f131867eb05354709dc237ea1096c7dec3408e69336c76f4c45939c5fba29dfc
Opcode Fuzzy Hash: 236bc0f4d8ae6d876ebc504a913f47c0fcaf4430aad8bc8c565e490f5cc901d8
Instruction Fuzzy Hash: AB011AB1800269DFEB14CF69C8453EE7BF1FB48320F148625E424AA2D0D7744A46CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 053E0DD0, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb9f9ab3055bf2a86b177f827db2b7be3e7e32e18c9cf0103a80e05f57d26324
Instruction ID: a7ae6ecaf09e5bffa6e03509a5c7b93ac7ee6efeded9e04db847f510bbc8aca6
Opcode Fuzzy Hash: fb9f9ab3055bf2a86b177f827db2b7be3e7e32e18c9cf0103a80e05f57d26324
Instruction Fuzzy Hash: 29F0F634B0016997C718BA688466AAFB7FB9F84204F400C6EE506AB7C4CEB92E0087D5

Uniqueness

Uniqueness Score: -1.00%

Function 053E2120, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe2cb55b7b7629123161ec05793768391a763da3f4adad329137444fc6f95bb8
Instruction ID: 344025b579a6ab9b60b790d068fba91527dc7a9910432fe416f7759775fe83cc
Opcode Fuzzy Hash: fe2cb55b7b7629123161ec05793768391a763da3f4adad329137444fc6f95bb8
Instruction Fuzzy Hash: B4F04C35A001658BCB18BB74C5223AE77B69F88208F14085ED106BB784CFB91D11DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 053E1078, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd4fb6f7d8c2395756b07cd89907c3c8a9ea12be1fef68602a137589baccdb6
Instruction ID: 9e5a2900f8519768e46def871cd154b0920e93ab75d2ac32a1f3824ca8502601
Opcode Fuzzy Hash: 0fd4fb6f7d8c2395756b07cd89907c3c8a9ea12be1fef68602a137589baccdb6
Instruction Fuzzy Hash: 2EF0B431B052581FCB19EBB5CC5A46F7FFA9F85214F1480BAD009CB681EE709C058B91

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D730, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.413653691.0000000000F9D000.00000040.00000001.sdmp, Offset: 00F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_f9d000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e68e35098c3bd180fc5e822994bd58c6f93790ed7f55d6002f1953c2d19b779
Instruction ID: 409ce8c79d576d969c0da1d9b399177a8a46e5150b6f1cf58d93f6a3b56ee4d2
Opcode Fuzzy Hash: 7e68e35098c3bd180fc5e822994bd58c6f93790ed7f55d6002f1953c2d19b779
Instruction Fuzzy Hash: 87F062724043449AFB148A15CDC4B62FF98EB91778F28C56AED085B686C3789C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 053EB2BF, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dbbc4e35c4653d1ac512ca7711dcb5ec4b1eef069d75c67f47b9aaef6d7da29
Instruction ID: ad656149ff92c6a3e0f62a24944d15a38bedc6386ee0003c8eca98e3f70ea6b7
Opcode Fuzzy Hash: 0dbbc4e35c4653d1ac512ca7711dcb5ec4b1eef069d75c67f47b9aaef6d7da29
Instruction Fuzzy Hash: CEF0E93311D2A45FD3168669DC533D17BA5EF43258B0A05EBC080DB2A2D955D9068795

Uniqueness

Uniqueness Score: -1.00%

Function 053E7578, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e1f627a988349c453dead452514ee127b39675c024e884a283481da32525308
Instruction ID: 35e1e4b0fc15caed7b8320434fd2710dbc2fe04582471616303928003dd0a371
Opcode Fuzzy Hash: 8e1f627a988349c453dead452514ee127b39675c024e884a283481da32525308
Instruction Fuzzy Hash: 2801BB70804269DFDB14DF6AC8087AEBBF5FF48354F148625E825AA2D0DBB44A45CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 053E67C0, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3759df4eb0bd27222f58f9b0f3d8edd000870b3d094006de30ced19071d6fb85
Instruction ID: 8ba74357ca907bfc620e8c0079a29a6f2eb549be801d7157f7d2bc8913e2cf07
Opcode Fuzzy Hash: 3759df4eb0bd27222f58f9b0f3d8edd000870b3d094006de30ced19071d6fb85
Instruction Fuzzy Hash: F5E06D72B052151BA32016BB6C896377ACEEBC8630B18423AF409C3290EE618C0596B2

Uniqueness

Uniqueness Score: -1.00%

Function 053EE9F0, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415a98354f481804678503669b410b367e1382afbbb7bb76b5bfc71221c3715a
Instruction ID: b105c5b1868ae04cfa1ddd1b704dd66ce8f7e3962ddbf292189fdf1a2f6bd757
Opcode Fuzzy Hash: 415a98354f481804678503669b410b367e1382afbbb7bb76b5bfc71221c3715a
Instruction Fuzzy Hash: 4E01B675D10609DFCB40EFACC54489DBBF4FF49210B1185AAE859EB321E770AA44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 053E7618, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb8098f64f274ad60e94e55b7b2f73d1c2299113c74e10c99a755aadb03a72ec
Instruction ID: 7ee3ed7cd8cdd8bb4abfe0740c38e6f9fff81ed0b633cf97773d2afe5d1e1a52
Opcode Fuzzy Hash: cb8098f64f274ad60e94e55b7b2f73d1c2299113c74e10c99a755aadb03a72ec
Instruction Fuzzy Hash: 47E06D72B042286F5314DB6EDC84C6BBBEEEBCD674351813AF50CC7310DA309D0086A0

Uniqueness

Uniqueness Score: -1.00%

Function 053E2E1B, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e21b11138a5225cfc085cc8c0e5e18b963e63d02e48b2b4ddabaf6ca16916f
Instruction ID: 87187ca43d88b945e5f8bf932bfa1b79aa53c5acf37cd3590cc2be12b861bf6d
Opcode Fuzzy Hash: 86e21b11138a5225cfc085cc8c0e5e18b963e63d02e48b2b4ddabaf6ca16916f
Instruction Fuzzy Hash: 6FF0E23A6002349FD7209B55D808F73B7EDFBC4320F0A8425E85ADB780C7A0E880CB91

Uniqueness

Uniqueness Score: -1.00%

Function 053EB31C, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a6f66af47db5a7e05584f7e52fb347eebc52f6b4e60031229afd1656f83f7c
Instruction ID: 5f9be2f328876b394c288c11ab1e458de67b651e3d88dfc8b96ab25532f8617c
Opcode Fuzzy Hash: 10a6f66af47db5a7e05584f7e52fb347eebc52f6b4e60031229afd1656f83f7c
Instruction Fuzzy Hash: 8CF02B1220D7E46FC31352B99C66361BFE8DE4304974D05DFD0C1CB193D948D4028391

Uniqueness

Uniqueness Score: -1.00%

Function 053ECD58, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3dc51f14cb3e2a76e647bfb0778124d889c802f6ab75f0400a7cc893f4b5be
Instruction ID: cdb71cee1379154ec51fac6915f9421a48c1c94491ea38f5172e5ae490d87204
Opcode Fuzzy Hash: ef3dc51f14cb3e2a76e647bfb0778124d889c802f6ab75f0400a7cc893f4b5be
Instruction Fuzzy Hash: B5E09271B10A254BDB08EBAEA40086BF6DBAFC8614318C17FD80DCB724ED719D014A88

Uniqueness

Uniqueness Score: -1.00%

Function 053E0DB0, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46f42da5dce783b6e53e8169afb4d35076badfd56d13db8ae9e5bdba1f29f69
Instruction ID: 8a2fa9a15b6b361779cd3a897aca31026bf1d1d63221cb1fbadb2e2836a9debe
Opcode Fuzzy Hash: f46f42da5dce783b6e53e8169afb4d35076badfd56d13db8ae9e5bdba1f29f69
Instruction Fuzzy Hash: 03F0A030209319CFC315AB39C4544367BE5BA4220431489AED009DB792CA35E844CB81

Uniqueness

Uniqueness Score: -1.00%

Function 053E67D0, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca49cabf9d63ce08d29b536cadfae9b32cb19485b09c97d8e8a3c5d37665fc5a
Instruction ID: 001899cce82407263c564018c095ad2b408c50141dc349c78f8f6c1c5074bbf0
Opcode Fuzzy Hash: ca49cabf9d63ce08d29b536cadfae9b32cb19485b09c97d8e8a3c5d37665fc5a
Instruction Fuzzy Hash: 72E0C232B052241B272412EF2C9943BBACEEBCD230314413AF50DC3380EDA18C0692B1

Uniqueness

Uniqueness Score: -1.00%

Function 053E88B0, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92790de14feb08d7bc7a8aed53c59ee7d59cf3e2edd93f4b28264db2583acb3d
Instruction ID: 780faf4f3f6e497c1bd0ee4f745883d670d389febdbaadadcb90208bb49ad4a1
Opcode Fuzzy Hash: 92790de14feb08d7bc7a8aed53c59ee7d59cf3e2edd93f4b28264db2583acb3d
Instruction Fuzzy Hash: F3E09233A50538C7C300DB58F4815B5B7E9F7446693188597ED0DCAA10D373D866D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 053E7661, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79fc1fa984383ef0cd0bad4444833b34e04e870caff99b7e27bbfad9e7d06b8b
Instruction ID: 40b6cb13603a8afd198bebde6ce29f2b7d78688b208a5d1ebfc889d961e29481
Opcode Fuzzy Hash: 79fc1fa984383ef0cd0bad4444833b34e04e870caff99b7e27bbfad9e7d06b8b
Instruction Fuzzy Hash: BBE04F3B2405515BC310960DE845FC6FBA9DF89630F558066F649C73A1DA60E841C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 053E1C88, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235e5d7f13cb6e85f1b737547d2e781c0acdd39919aaa6a628edd2aae481eb38
Instruction ID: a6e87e88fbdcdff8d13b39cdf9ebda31bfc6837d6026b125826e1bfc47ac703f
Opcode Fuzzy Hash: 235e5d7f13cb6e85f1b737547d2e781c0acdd39919aaa6a628edd2aae481eb38
Instruction Fuzzy Hash: 60E0867660121887CB10B7B5D9447767FD9DF86654F000524C0148F7C5DB7AAC5087A0

Uniqueness

Uniqueness Score: -1.00%

Function 053ED560, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07fa0f0e1d41a31033eb7730789e08cc684a6ff24fae9dd94124722bead86187
Instruction ID: f70a6029d9ed4fe6818c86956ef1ebc25f4669bbadf11b65d4e73808d23ebcb7
Opcode Fuzzy Hash: 07fa0f0e1d41a31033eb7730789e08cc684a6ff24fae9dd94124722bead86187
Instruction Fuzzy Hash: DEE017373508249FC700AA5CE855ADABBEAEF58635B248067F945C73A1DB61DC0086E8

Uniqueness

Uniqueness Score: -1.00%

Function 053EB2F0, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ae050b8a15a95f7e672c3dc660f4f8b7e1bb8c1eea4c092f75962bfd42b8c6
Instruction ID: 4e6a00a5915a4438813ec78a19de2f78f05431cb0d722fe818a83a15160d0c99
Opcode Fuzzy Hash: 94ae050b8a15a95f7e672c3dc660f4f8b7e1bb8c1eea4c092f75962bfd42b8c6
Instruction Fuzzy Hash: E3D0A733344238CF4B1537B4781966D73CDAF84566300007EE50EC3650DF61880253C4

Uniqueness

Uniqueness Score: -1.00%

Function 053E1CD8, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a630b25b412eecd1465e8af18605de25e104de687eba4cd1ededd7a3df51cb
Instruction ID: 6edb458132723dc29c949f07446cca39f022929ab68693d3db68737fa83a244f
Opcode Fuzzy Hash: d0a630b25b412eecd1465e8af18605de25e104de687eba4cd1ededd7a3df51cb
Instruction Fuzzy Hash: 9EE04671B01321CFC358AFB8D08462637E2AB80315B14C67EC41A9B760CB76E881CB40

Uniqueness

Uniqueness Score: -1.00%

Function 053E7670, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9101dc6e2a51d4cad5c7440870dbc4bfb16063e74de0ba875f9b38c01ef521b8
Instruction ID: 3c5d1b2da0752757679b892573d19ac8bbc96e5e693f66b2f9365819e541f542
Opcode Fuzzy Hash: 9101dc6e2a51d4cad5c7440870dbc4bfb16063e74de0ba875f9b38c01ef521b8
Instruction Fuzzy Hash: 68D012363405149FC3149A4AD808D46BBA9DFC9731B158066F609C7370CA71EC01C794

Uniqueness

Uniqueness Score: -1.00%

Function 053EACF8, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c824275c34af8f0d4b4a7b0f67143125189089ae1e53eecc5a12168b6f155bec
Instruction ID: 6a75e5da826a7c119624175854b4b6a78b83bed5c3007fe491ab91e60ca1d715
Opcode Fuzzy Hash: c824275c34af8f0d4b4a7b0f67143125189089ae1e53eecc5a12168b6f155bec
Instruction Fuzzy Hash: 09E04F711456855FC702CF30C955D973FA1AF06201B09849AF5898B673C230D564D722

Uniqueness

Uniqueness Score: -1.00%

Function 053EAED3, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56e50ab86a644c142f8997f652952751d6869024f3b934d3fe5eef1b9f1cc8f
Instruction ID: 13f0c16ddc78ae87e9a7e794a463da945354340e1273ded66c48dccd655adbeb
Opcode Fuzzy Hash: f56e50ab86a644c142f8997f652952751d6869024f3b934d3fe5eef1b9f1cc8f
Instruction Fuzzy Hash: F7E04F36A0110DEBCF01DF80E844BDEBB72FF88314F204011FA1127290C3324A21DB90

Uniqueness

Uniqueness Score: -1.00%

Function 053ED570, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36ad5f6053c834e6a65c1473399e907d5d14ac510b0ae79b45fffe7ead3b5378
Instruction ID: 061c462405c8803484aed1c0be964228dc83a1c00c77a6a08eadf061398dc0ab
Opcode Fuzzy Hash: 36ad5f6053c834e6a65c1473399e907d5d14ac510b0ae79b45fffe7ead3b5378
Instruction Fuzzy Hash: 65D0C9363105249F8704AB68E508CA97BEAEB5D66131180A6F909C7361CF71DC109BD4

Uniqueness

Uniqueness Score: -1.00%

Function 053E6EF0, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e61948b95b8823daefbf618cd4fc5394639a5335fcd52f3eaa05f67f5a9c34c6
Instruction ID: 4ea7825ac64022069e0c533ce9416e0785a1ca48c8d78f8d670ffe5bd1e4bcae
Opcode Fuzzy Hash: e61948b95b8823daefbf618cd4fc5394639a5335fcd52f3eaa05f67f5a9c34c6
Instruction Fuzzy Hash: DDC08C3F0100145FC221E6C8E896FE2BBB8FF04238F548063F088E6420E224C0689B11

Uniqueness

Uniqueness Score: -1.00%

Function 053EAD08, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f412df58b1162d58c239ccc362c7d1db1b5979eef2ebe541bda376bc1fe5ec41
Instruction ID: ce0e19a3d32d16bd03677d3bb2f906ec3caef425ca8f7169544ec8c961c0f2f3
Opcode Fuzzy Hash: f412df58b1162d58c239ccc362c7d1db1b5979eef2ebe541bda376bc1fe5ec41
Instruction Fuzzy Hash: ACD0C93610010CEFCB01CF95D944D9A3BBAFF48710F008054FA084B232C332E820EB61

Uniqueness

Uniqueness Score: -1.00%

Function 053E6720, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe14dc5cd39eefb69f3ea9e40eeee8013d7e0dc88b9b33ae7421c6c3382cfea
Instruction ID: 51d1823baf13b51efc80e55cb04ad0eeb77ba22b7be1e239ba44f154b52d5887
Opcode Fuzzy Hash: 8fe14dc5cd39eefb69f3ea9e40eeee8013d7e0dc88b9b33ae7421c6c3382cfea
Instruction Fuzzy Hash: 23C08C320102089FD300EF39D88EF807BEEEF08714F684090E10897233D722E8048B00

Uniqueness

Uniqueness Score: -1.00%

Function 053EB591, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 074405a647274be9a73e88da898f5c741cdad16b8be09eb04d27d77925186580
Instruction ID: 7b59fda6ee50ff1208113af248489b3595292b01425b5b037bbbc627db0c6145
Opcode Fuzzy Hash: 074405a647274be9a73e88da898f5c741cdad16b8be09eb04d27d77925186580
Instruction Fuzzy Hash: 2FB0125B64047002E600F56E9CE17D311D39FC0027FCDC42141C0D8180DD18C4420075

Uniqueness

Uniqueness Score: -1.00%

Function 053E67A0, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4390906556f68ccc5de6f0d0d3cda5e63dd28120971441c369d30dc522c998dc
Instruction ID: 04c65c8618ea5d90b74ab6393ec858b810825df501ea6d9a645153097a5af156
Opcode Fuzzy Hash: 4390906556f68ccc5de6f0d0d3cda5e63dd28120971441c369d30dc522c998dc
Instruction Fuzzy Hash: 66C08C328222088AEB004B33740E3603B69E784110F48802AB04441890EF312040A712

Uniqueness

Uniqueness Score: -1.00%

Function 053E6E21, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d19e37669473b857fe151925178dc767f9f8cfafe1615945727f0286e895b3b7
Instruction ID: eca7daa329e1e7f7ba58de3df834ba232cc59d1ba3fd49d63adc4862dc3f86e7
Opcode Fuzzy Hash: d19e37669473b857fe151925178dc767f9f8cfafe1615945727f0286e895b3b7
Instruction Fuzzy Hash: 7FC02B53601B0482E3102300EC07BA3BF4CC790724FC58081E0CDC01B1DE29D4118140

Uniqueness

Uniqueness Score: -1.00%

Function 053E247C, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f463e70e463d1b705261b5d4b9aaaa92e088b4191f08b9abcc1240737b9d81
Instruction ID: a823aebaea1905d20282ec7843250e5c917e05b473dac451432e738ebb5fdd4e
Opcode Fuzzy Hash: 16f463e70e463d1b705261b5d4b9aaaa92e088b4191f08b9abcc1240737b9d81
Instruction Fuzzy Hash: 59C09B3E1251159E4745F750C548D66B6FBFF557847408C52B14487071CF25D534DB52

Uniqueness

Uniqueness Score: -1.00%

Function 053E6780, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c28a67e0cb21b12b717140bcedfbc99a956b9953291e6eb1927d417c4c21b32
Instruction ID: b894b06e3e52cf25c46d3d692ae45d662f34181754ed291eda300989be2da365
Opcode Fuzzy Hash: 3c28a67e0cb21b12b717140bcedfbc99a956b9953291e6eb1927d417c4c21b32
Instruction Fuzzy Hash: 67C09B3284560CCFD3405B73781D7953B6CF745321F8C0666E44841410EB555554D755

Uniqueness

Uniqueness Score: -1.00%

Function 053E4F7B, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aaeb5dc602126fd664e6ed9c08c4b58d5dd3742dc9d766503dffccf3a5e49c7
Instruction ID: 891682c52decd249da01448d803898fd2382f5f07df3aa8096d709da807ec6eb
Opcode Fuzzy Hash: 1aaeb5dc602126fd664e6ed9c08c4b58d5dd3742dc9d766503dffccf3a5e49c7
Instruction Fuzzy Hash: CCC0C93094052ACFCB208B10C405AA877B6AB88300F21C5E4C10A67A90E6309D81AF20

Uniqueness

Uniqueness Score: -1.00%

Function 053E9FEC, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05443f4fbe8a1cb7a86ce552d1c8ab652c9524218b87484640f0959452273e49
Instruction ID: 79e03d3eb4cb403ce4267147adfb94f30bdacbc4a3983c624d4bbcea216cca51
Opcode Fuzzy Hash: 05443f4fbe8a1cb7a86ce552d1c8ab652c9524218b87484640f0959452273e49
Instruction Fuzzy Hash: 01B0113B2203328A2A00F23A88E8A3A80ABBBC02003C8CC002002A00C08E28A2030222

Uniqueness

Uniqueness Score: -1.00%

Function 053EAECA, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc304a26ba6a9b8e09db51e88682a954301326f375d2764bec1dfa900b44145
Instruction ID: 60f620e5195e4e3ef0976d95386648c3e9e886a4e1e234fa591abed6b4f5ed04
Opcode Fuzzy Hash: 8fc304a26ba6a9b8e09db51e88682a954301326f375d2764bec1dfa900b44145
Instruction Fuzzy Hash: 1EB09237A0401889DB008A84B4453EEF765E780325F104023C211534818372016496D1

Uniqueness

Uniqueness Score: -1.00%

Function 053E6730, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1cdb4f687ab12025e8389c2fb21792c812de654467923881419b2744bb53e71
Instruction ID: 7de4840db72a739a7296ecabbd3d178890c8b70a70b6a7fce96b4b1d731f9c0f
Opcode Fuzzy Hash: d1cdb4f687ab12025e8389c2fb21792c812de654467923881419b2744bb53e71
Instruction Fuzzy Hash: 6AB092341502088F82409B59D449C00BBE8AF08A243454090E1088B632C621F8008A40

Uniqueness

Uniqueness Score: -1.00%

Function 053E558F, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f03ee35d03d8834b9489bc2bf1a31d247b101b95117db37d944f86d56b4259
Instruction ID: 2d32e24d62c5fff3b604c0ae01d591cb6cc8c01a8084e14b3efc5c16a13ab510
Opcode Fuzzy Hash: c0f03ee35d03d8834b9489bc2bf1a31d247b101b95117db37d944f86d56b4259
Instruction Fuzzy Hash: C3B09230D010688BEB20EB948550296BAE39B49320F14C1A9881D5B28ADA348F419BA2

Uniqueness

Uniqueness Score: -1.00%

Function 053E67B0, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8162f451a48ac82aca2cf38a0bc3bd237cec4b1a48bf0912d46d25f0c24803e7
Instruction ID: c75a10b85e2af3073dcf9872e2a34e05de4072b9f6b0a4b1ede8e6d23bccbed9
Opcode Fuzzy Hash: 8162f451a48ac82aca2cf38a0bc3bd237cec4b1a48bf0912d46d25f0c24803e7
Instruction Fuzzy Hash: DEA0223200030C838A002AB3380E0223B0EC2C8020B00C022B00C00082AE32A000B0A2

Uniqueness

Uniqueness Score: -1.00%

Function 053E6790, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5a3743a8659b2b26b345bf0ee1d67799d4e6d7c73beaa53c9f0451042cbebf
Instruction ID: 760071edb386443d63373444856dcfb6ba13e87254cb06c38c94fd532696e65f
Opcode Fuzzy Hash: 2a5a3743a8659b2b26b345bf0ee1d67799d4e6d7c73beaa53c9f0451042cbebf
Instruction Fuzzy Hash: 6390023205960C8B56502B96780E95A7B5CA585525FC400A2F50D415516F56A41495A5

Uniqueness

Uniqueness Score: -1.00%

Function 053E6E30, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7153202ee4eba11fbebd7606aa6bf1e5b60957ed8a44f7462b425f9ee5d68915
Instruction ID: 51a5bde418cc2329e0293ca3aa9b77425b669b69b1750d761e5d1cdd53584b3f
Opcode Fuzzy Hash: 7153202ee4eba11fbebd7606aa6bf1e5b60957ed8a44f7462b425f9ee5d68915
Instruction Fuzzy Hash: 06900272055A0C8B45503796780E965BB5C9584535BC04192F50D415526F66A41495A5

Uniqueness

Uniqueness Score: -1.00%

Function 053E399C, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3205261536cf2bd238b0f35e36bade702b959b650db4753b8c9d20c1b2457844
Instruction ID: e8b7a24a743fce978ee59c90deb763c9d9f119c526ae38007ffacfb8010099b1
Opcode Fuzzy Hash: 3205261536cf2bd238b0f35e36bade702b959b650db4753b8c9d20c1b2457844
Instruction Fuzzy Hash: 0DA00230649922DB4708A770556827C65FF56457463151F15E113919C0EB2019189622

Uniqueness

Uniqueness Score: -1.00%

Function 053E3991, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.417561316.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_53e0000_dhcpmon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f6559075dd329838af26c26728b032ed8ac39d4c7887a6f4a0b27cffbe209b9
Instruction ID: 43a6e4e12363b13f7ed74b46a8367b866820fbd3b09bbc905edd7254b2ce19d3
Opcode Fuzzy Hash: 7f6559075dd329838af26c26728b032ed8ac39d4c7887a6f4a0b27cffbe209b9
Instruction Fuzzy Hash: 24A00130949924CBC758EA5198686A876BAAB46705B101984E10B62E818B306D94EE65

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028 Parent PID: 6384 NEW PRICE ENQUIRY FROM PHILLIPINES.exeCOMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	88
Total number of Limit Nodes:	8

Executed Functions

Function 0123B6C0, Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0123B730
GetCurrentThread.KERNEL32 ref: 0123B76D
GetCurrentProcess.KERNEL32 ref: 0123B7AA
GetCurrentThreadId.KERNEL32 ref: 0123B803

Memory Dump Source

Source File: 00000009.00000002.420759806.0000000001230000.00000040.00000001.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1230000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5b12df8329c8fce497459af3a652b2037db8fe9430e6a6b10139b509d35d12a0
Instruction ID: 37b8bc70e6d484c6f0023d17bc4672ff2049ad166fc3ae0cf7be5d2fd01ce810
Opcode Fuzzy Hash: 5b12df8329c8fce497459af3a652b2037db8fe9430e6a6b10139b509d35d12a0
Instruction Fuzzy Hash: 835154B0D003498FDB14CFAAD5897DEBBF1EF89314F24846AE019A7391C7746886CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0123B6D0, Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0123B730
GetCurrentThread.KERNEL32 ref: 0123B76D
GetCurrentProcess.KERNEL32 ref: 0123B7AA
GetCurrentThreadId.KERNEL32 ref: 0123B803

Memory Dump Source

Source File: 00000009.00000002.420759806.0000000001230000.00000040.00000001.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1230000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5da3d45924a40b02724165f67af5b2729b5d914fcca6c66bdc76773598f1c354
Instruction ID: 37c9d604ed0ed6132458a609ed0ad880803a265d96d75af9324575a878027216
Opcode Fuzzy Hash: 5da3d45924a40b02724165f67af5b2729b5d914fcca6c66bdc76773598f1c354
Instruction Fuzzy Hash: C85134B0D007098FDB14CFAAD549BDEBBF1EB88314F24846AE029A7390C7746885CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0123FAA0, Relevance: 1.8, APIs: 1, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0123FD0A

Memory Dump Source

Source File: 00000009.00000002.420759806.0000000001230000.00000040.00000001.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1230000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 24d10690970eee0fae3f345ca730c91cc4a3473cf7617ad8a0abd346773624b1
Instruction ID: bce337e1d69b50e88fdc8444ebd5a14d32b44c5d9e9ccaedf7bd6e357a3ee8e7
Opcode Fuzzy Hash: 24d10690970eee0fae3f345ca730c91cc4a3473cf7617ad8a0abd346773624b1
Instruction Fuzzy Hash: 7B919D71C483C99FDF02DFA8C8A09DDBFB1EF4A210F1841AAE494AB262D7395456CF51

Uniqueness

Uniqueness Score: -1.00%

Function 012393E8, Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.420759806.0000000001230000.00000040.00000001.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1230000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 718cc4482065c0a31373f53667e6320187c26f45d60073c8a6b6bd2408eb324e
Instruction ID: e2c5af52722b379bf843f8939df5a45d1c7c064ab8166ad7bb35ae1f74480ecb
Opcode Fuzzy Hash: 718cc4482065c0a31373f53667e6320187c26f45d60073c8a6b6bd2408eb324e
Instruction Fuzzy Hash: 387125B0A10B068FDB24DF2AD04166ABBF1FF89318F008A2DD59AD7A50D774E855CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0123FBF8, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0123FD0A

Memory Dump Source

Source File: 00000009.00000002.420759806.0000000001230000.00000040.00000001.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1230000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b58c95aac05dcb2cf6e3f741d7930f560ea5b02e4f5ce930fdf8b9402755644d
Instruction ID: 1482dddacb6ee02e23daaff7f2507045458287c2df3768e6208dfe901ceb6fdd
Opcode Fuzzy Hash: b58c95aac05dcb2cf6e3f741d7930f560ea5b02e4f5ce930fdf8b9402755644d
Instruction Fuzzy Hash: 8141DEB1D10309DFDF14CF99D984ADEBBB5BF88314F24822AE819AB210D774A845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0123BCF9, Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0123BD87

Memory Dump Source

Source File: 00000009.00000002.420759806.0000000001230000.00000040.00000001.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1230000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8a5670af1d4d985b19d1bfc408a0e92d1fd473a38f4459e682a1eab5a4c7f31a
Instruction ID: 7932222df48a589ff6c287d8cde8f31fe9af77bf60ff54ef8b38c23f90d29824
Opcode Fuzzy Hash: 8a5670af1d4d985b19d1bfc408a0e92d1fd473a38f4459e682a1eab5a4c7f31a
Instruction Fuzzy Hash: 3921D2B5D00248DFDB10CFA9D885AEEBBF4EB48324F14802AE955A3350D378A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0123BD00, Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0123BD87

Memory Dump Source

Source File: 00000009.00000002.420759806.0000000001230000.00000040.00000001.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1230000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2e2a6acbf349dfd63ada5a75d0ae2fae85e0855e108c793cac45e78b26bbbc94
Instruction ID: e886544d868e6188f1ba784832ab2b2c0de58f647e5429d3ce4b539afb38e53d
Opcode Fuzzy Hash: 2e2a6acbf349dfd63ada5a75d0ae2fae85e0855e108c793cac45e78b26bbbc94
Instruction Fuzzy Hash: 1821C4B5900309DFDB10CF99D885ADEBBF4EB48324F14842AE914A3350D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01239849, Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 012398BA

Memory Dump Source

Source File: 00000009.00000002.420759806.0000000001230000.00000040.00000001.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1230000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 14b8d1ebfa2322b9c42c8928de659b1c491726724aeeaf553c1481bbf31b8e32
Instruction ID: d5ef1d6e48221ee3bf1c529127d108ea11e1ac79373808041dc05937ccc3982f
Opcode Fuzzy Hash: 14b8d1ebfa2322b9c42c8928de659b1c491726724aeeaf553c1481bbf31b8e32
Instruction Fuzzy Hash: 222122B2D002498FDB10CFAAC444ADEFBF4AB89364F14842ED425A7200C3B9A546CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01239850, Relevance: 1.6, APIs: 1, Instructions: 52
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 012398BA

Memory Dump Source

Source File: 00000009.00000002.420759806.0000000001230000.00000040.00000001.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1230000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5751634f91778a948fdfa1736d0c9f190217303eaedbc21f03c2225825758a6a
Instruction ID: 5b45e4267f03b50f9b31df2ddd3a2a0612f396ffa1e3ad603757ee1644164a2f
Opcode Fuzzy Hash: 5751634f91778a948fdfa1736d0c9f190217303eaedbc21f03c2225825758a6a
Instruction Fuzzy Hash: 3F11D0B6D002098FDB14CF9AD844ADEFBF4EB89364F14842AD529A7600C3B9A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01238704, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,012393FB), ref: 0123962E

Memory Dump Source

Source File: 00000009.00000002.420759806.0000000001230000.00000040.00000001.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1230000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f618f760b6da6c96482966b38397b8221c59830e458f51e0ac665d8e0b9d2a5f
Instruction ID: 82537ce055a179e9a0413a5e747ec30561b0bf6463351f5ca938b2c4bac2e290
Opcode Fuzzy Hash: f618f760b6da6c96482966b38397b8221c59830e458f51e0ac665d8e0b9d2a5f
Instruction Fuzzy Hash: EF11F3B1D006098FDB10CF9AD445BDEFBF4EB89328F10852AD529A7240C3B4A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0123FE38, Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?), ref: 0123FE9D

Memory Dump Source

Source File: 00000009.00000002.420759806.0000000001230000.00000040.00000001.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1230000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 4ed4fc76a7a20725bde401658d6a806ffef52d84017f4957674bccead34045e4
Instruction ID: 8d48dc97fdf359459c59d4aa5118b9519807d06c84bec07d61c8af255a2d0dae
Opcode Fuzzy Hash: 4ed4fc76a7a20725bde401658d6a806ffef52d84017f4957674bccead34045e4
Instruction Fuzzy Hash: 6D1133B5D002498FDB10CF99D585BDEBBF4EB88364F14846AE854A3301C3B8A941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0123FE40, Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?), ref: 0123FE9D

Memory Dump Source

Source File: 00000009.00000002.420759806.0000000001230000.00000040.00000001.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1230000_NEW PRICE ENQUIRY FROM PHILLIPINES.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 0e0486c3f7c19a88e48bcf1142596e5977dfb2a63f40932991112435859fc4d9
Instruction ID: 2834551bdd660ca94f7f2fd0ce90d26ecc5314b59831a632562529df39920250
Opcode Fuzzy Hash: 0e0486c3f7c19a88e48bcf1142596e5977dfb2a63f40932991112435859fc4d9
Instruction Fuzzy Hash: EF1103B5C002098FDB10CF99D585BDFBBF8EB88324F10841AD914A3341C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

AV Detection:

E-Banking Fraud:

System Summary:

Stealing of Sensitive Information:

Remote Access Functionality:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Function 03109828, Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Function 0310405C, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0310569D, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0310A584, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0310BD30, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 03108B80, Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON