Play interactive tour

Edit tour

Windows Analysis Report NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Overview

General Information

Sample Name:	NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Analysis ID:	552509
MD5:	ca0d3ca986e592ec436052f747f833c0
SHA1:	8bdb8ebea5444c42c75c0b30ac8628d06c6cbce0
SHA256:	5e4ccf3d7a2885ab1f1ce83b855ec6f8b771b1731fad4807f8d57b250a5505ad
Tags:	exeNanoCore
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Yara detected AntiVM3

Detected Nanocore Rat

Multi AV Scanner detection for dropped file

Yara detected Nanocore RAT

Initial sample is a PE file and has a suspicious name

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Sigma detected: Suspicius Add Task From User AppData Temp

.NET source code contains potential unpacker

.NET source code contains method to dynamically call methods (often used by packers)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses dynamic DNS services

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

NEW PRICE ENQUIRY FROM PHILLIPINES.exe (PID: 976 cmdline: "C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe" MD5: CA0D3CA986E592EC436052F747F833C0)

NEW PRICE ENQUIRY FROM PHILLIPINES.exe (PID: 6296 cmdline: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe MD5: CA0D3CA986E592EC436052F747F833C0)

schtasks.exe (PID: 4544 cmdline: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5096 cmdline: schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp3019.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

NEW PRICE ENQUIRY FROM PHILLIPINES.exe (PID: 6384 cmdline: "C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe" 0 MD5: CA0D3CA986E592EC436052F747F833C0)

NEW PRICE ENQUIRY FROM PHILLIPINES.exe (PID: 6028 cmdline: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe MD5: CA0D3CA986E592EC436052F747F833C0)

dhcpmon.exe (PID: 4800 cmdline: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0 MD5: CA0D3CA986E592EC436052F747F833C0)

dhcpmon.exe (PID: 5644 cmdline: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe MD5: CA0D3CA986E592EC436052F747F833C0)

dhcpmon.exe (PID: 3832 cmdline: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" MD5: CA0D3CA986E592EC436052F747F833C0)

dhcpmon.exe (PID: 6728 cmdline: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe MD5: CA0D3CA986E592EC436052F747F833C0)

dhcpmon.exe (PID: 6780 cmdline: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe MD5: CA0D3CA986E592EC436052F747F833C0)

dhcpmon.exe (PID: 6992 cmdline: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe MD5: CA0D3CA986E592EC436052F747F833C0)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000005.00000002.405885407.00000000023F1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1831cd:$x1: NanoCore.ClientPluginHost 0x1b5ded:$x1: NanoCore.ClientPluginHost 0x2a897d:$x1: NanoCore.ClientPluginHost 0x18320a:$x2: IClientNetworkHost 0x1b5e2a:$x2: IClientNetworkHost 0x2a89ba:$x2: IClientNetworkHost 0x186d3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b995d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2ac4ed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182f35:$a: NanoCore 0x182f45:$a: NanoCore 0x183179:$a: NanoCore 0x18318d:$a: NanoCore 0x1831cd:$a: NanoCore 0x1b5b55:$a: NanoCore 0x1b5b65:$a: NanoCore 0x1b5d99:$a: NanoCore 0x1b5dad:$a: NanoCore 0x1b5ded:$a: NanoCore 0x2a86e5:$a: NanoCore 0x2a86f5:$a: NanoCore 0x2a8929:$a: NanoCore 0x2a893d:$a: NanoCore 0x2a897d:$a: NanoCore 0x182f94:$b: ClientPlugin 0x183196:$b: ClientPlugin 0x1831d6:$b: ClientPlugin 0x1b5bb4:$b: ClientPlugin 0x1b5db6:$b: ClientPlugin 0x1b5df6:$b: ClientPlugin
00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4356d:$a: NanoCore 0x435c6:$a: NanoCore 0x43603:$a: NanoCore 0x4367c:$a: NanoCore 0x56d27:$a: NanoCore 0x56d3c:$a: NanoCore 0x56d71:$a: NanoCore 0x6fd2b:$a: NanoCore 0x6fd40:$a: NanoCore 0x6fd75:$a: NanoCore 0x435cf:$b: ClientPlugin 0x4360c:$b: ClientPlugin 0x43f0a:$b: ClientPlugin 0x43f17:$b: ClientPlugin 0x56ae3:$b: ClientPlugin 0x56afe:$b: ClientPlugin 0x56b2e:$b: ClientPlugin 0x56d45:$b: ClientPlugin 0x56d7a:$b: ClientPlugin 0x6fae7:$b: ClientPlugin 0x6fb02:$b: ClientPlugin
00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x356d:$a: NanoCore 0x35c6:$a: NanoCore 0x3603:$a: NanoCore 0x367c:$a: NanoCore 0x16d27:$a: NanoCore 0x16d3c:$a: NanoCore 0x16d71:$a: NanoCore 0x2fd2b:$a: NanoCore 0x2fd40:$a: NanoCore 0x2fd75:$a: NanoCore 0x35cf:$b: ClientPlugin 0x360c:$b: ClientPlugin 0x3f0a:$b: ClientPlugin 0x3f17:$b: ClientPlugin 0x16ae3:$b: ClientPlugin 0x16afe:$b: ClientPlugin 0x16b2e:$b: ClientPlugin 0x16d45:$b: ClientPlugin 0x16d7a:$b: ClientPlugin 0x2fae7:$b: ClientPlugin 0x2fb02:$b: ClientPlugin
00000002.00000002.630554205.0000000005910000.00000004.00020000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000002.00000002.630554205.0000000005910000.00000004.00020000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4356d:$a: NanoCore 0x435c6:$a: NanoCore 0x43603:$a: NanoCore 0x4367c:$a: NanoCore 0x56d27:$a: NanoCore 0x56d3c:$a: NanoCore 0x56d71:$a: NanoCore 0x6fd2b:$a: NanoCore 0x6fd40:$a: NanoCore 0x6fd75:$a: NanoCore 0x435cf:$b: ClientPlugin 0x4360c:$b: ClientPlugin 0x43f0a:$b: ClientPlugin 0x43f17:$b: ClientPlugin 0x56ae3:$b: ClientPlugin 0x56afe:$b: ClientPlugin 0x56b2e:$b: ClientPlugin 0x56d45:$b: ClientPlugin 0x56d7a:$b: ClientPlugin 0x6fae7:$b: ClientPlugin 0x6fb02:$b: ClientPlugin
00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4356d:$a: NanoCore 0x435c6:$a: NanoCore 0x43603:$a: NanoCore 0x4367c:$a: NanoCore 0x56d27:$a: NanoCore 0x56d3c:$a: NanoCore 0x56d71:$a: NanoCore 0x6fd2b:$a: NanoCore 0x6fd40:$a: NanoCore 0x6fd75:$a: NanoCore 0x435cf:$b: ClientPlugin 0x4360c:$b: ClientPlugin 0x43f0a:$b: ClientPlugin 0x43f17:$b: ClientPlugin 0x56ae3:$b: ClientPlugin 0x56afe:$b: ClientPlugin 0x56b2e:$b: ClientPlugin 0x56d45:$b: ClientPlugin 0x56d7a:$b: ClientPlugin 0x6fae7:$b: ClientPlugin 0x6fb02:$b: ClientPlugin
00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1831cd:$x1: NanoCore.ClientPluginHost 0x1b5ded:$x1: NanoCore.ClientPluginHost 0x2a897d:$x1: NanoCore.ClientPluginHost 0x18320a:$x2: IClientNetworkHost 0x1b5e2a:$x2: IClientNetworkHost 0x2a89ba:$x2: IClientNetworkHost 0x186d3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b995d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2ac4ed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182f35:$a: NanoCore 0x182f45:$a: NanoCore 0x183179:$a: NanoCore 0x18318d:$a: NanoCore 0x1831cd:$a: NanoCore 0x1b5b55:$a: NanoCore 0x1b5b65:$a: NanoCore 0x1b5d99:$a: NanoCore 0x1b5dad:$a: NanoCore 0x1b5ded:$a: NanoCore 0x2a86e5:$a: NanoCore 0x2a86f5:$a: NanoCore 0x2a8929:$a: NanoCore 0x2a893d:$a: NanoCore 0x2a897d:$a: NanoCore 0x182f94:$b: ClientPlugin 0x183196:$b: ClientPlugin 0x1831d6:$b: ClientPlugin 0x1b5bb4:$b: ClientPlugin 0x1b5db6:$b: ClientPlugin 0x1b5df6:$b: ClientPlugin
00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000008.00000002.415561117.0000000002DE1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x69467:$a: NanoCore 0x694c0:$a: NanoCore 0x694fd:$a: NanoCore 0x69576:$a: NanoCore 0x694c9:$b: ClientPlugin 0x69506:$b: ClientPlugin 0x69e04:$b: ClientPlugin 0x69e11:$b: ClientPlugin 0x5f5e4:$e: KeepAlive 0x69951:$g: LogClientMessage 0x698d1:$i: get_Connected 0x5989d:$j: #=q 0x598cd:$j: #=q 0x59909:$j: #=q 0x59931:$j: #=q 0x59961:$j: #=q 0x59991:$j: #=q 0x599c1:$j: #=q 0x599f1:$j: #=q 0x59a0d:$j: #=q 0x59a3d:$j: #=q
0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x69467:$a: NanoCore 0x694c0:$a: NanoCore 0x694fd:$a: NanoCore 0x69576:$a: NanoCore 0x694c9:$b: ClientPlugin 0x69506:$b: ClientPlugin 0x69e04:$b: ClientPlugin 0x69e11:$b: ClientPlugin 0x5f5e4:$e: KeepAlive 0x69951:$g: LogClientMessage 0x698d1:$i: get_Connected 0x5989d:$j: #=q 0x598cd:$j: #=q 0x59909:$j: #=q 0x59931:$j: #=q 0x59961:$j: #=q 0x59991:$j: #=q 0x599c1:$j: #=q 0x599f1:$j: #=q 0x59a0d:$j: #=q 0x59a3d:$j: #=q
00000000.00000002.375378918.0000000003131000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6959b:$a: NanoCore 0x695f4:$a: NanoCore 0x69631:$a: NanoCore 0x696aa:$a: NanoCore 0x695fd:$b: ClientPlugin 0x6963a:$b: ClientPlugin 0x69f38:$b: ClientPlugin 0x69f45:$b: ClientPlugin 0x5f718:$e: KeepAlive 0x69a85:$g: LogClientMessage 0x69a05:$i: get_Connected 0x599d1:$j: #=q 0x59a01:$j: #=q 0x59a3d:$j: #=q 0x59a65:$j: #=q 0x59a95:$j: #=q 0x59ac5:$j: #=q 0x59af5:$j: #=q 0x59b25:$j: #=q 0x59b41:$j: #=q 0x59b71:$j: #=q
0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1831cd:$x1: NanoCore.ClientPluginHost 0x1b5ded:$x1: NanoCore.ClientPluginHost 0x2a897d:$x1: NanoCore.ClientPluginHost 0x18320a:$x2: IClientNetworkHost 0x1b5e2a:$x2: IClientNetworkHost 0x2a89ba:$x2: IClientNetworkHost 0x186d3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b995d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2ac4ed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182f35:$a: NanoCore 0x182f45:$a: NanoCore 0x183179:$a: NanoCore 0x18318d:$a: NanoCore 0x1831cd:$a: NanoCore 0x1b5b55:$a: NanoCore 0x1b5b65:$a: NanoCore 0x1b5d99:$a: NanoCore 0x1b5dad:$a: NanoCore 0x1b5ded:$a: NanoCore 0x2a86e5:$a: NanoCore 0x2a86f5:$a: NanoCore 0x2a8929:$a: NanoCore 0x2a893d:$a: NanoCore 0x2a897d:$a: NanoCore 0x182f94:$b: ClientPlugin 0x183196:$b: ClientPlugin 0x1831d6:$b: ClientPlugin 0x1b5bb4:$b: ClientPlugin 0x1b5db6:$b: ClientPlugin 0x1b5df6:$b: ClientPlugin
00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1831cd:$x1: NanoCore.ClientPluginHost 0x1b5ded:$x1: NanoCore.ClientPluginHost 0x2a897d:$x1: NanoCore.ClientPluginHost 0x18320a:$x2: IClientNetworkHost 0x1b5e2a:$x2: IClientNetworkHost 0x2a89ba:$x2: IClientNetworkHost 0x186d3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b995d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2ac4ed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182f35:$a: NanoCore 0x182f45:$a: NanoCore 0x183179:$a: NanoCore 0x18318d:$a: NanoCore 0x1831cd:$a: NanoCore 0x1b5b55:$a: NanoCore 0x1b5b65:$a: NanoCore 0x1b5d99:$a: NanoCore 0x1b5dad:$a: NanoCore 0x1b5ded:$a: NanoCore 0x2a86e5:$a: NanoCore 0x2a86f5:$a: NanoCore 0x2a8929:$a: NanoCore 0x2a893d:$a: NanoCore 0x2a897d:$a: NanoCore 0x182f94:$b: ClientPlugin 0x183196:$b: ClientPlugin 0x1831d6:$b: ClientPlugin 0x1b5bb4:$b: ClientPlugin 0x1b5db6:$b: ClientPlugin 0x1b5df6:$b: ClientPlugin
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x111150:$x1: NanoCore.ClientPluginHost 0x11118d:$x2: IClientNetworkHost 0x1145ec:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x11f33a:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x12b208:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x181d33:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x110eef:$a: NanoCore 0x110eff:$a: NanoCore 0x110f5a:$a: NanoCore 0x110f69:$a: NanoCore 0x1110fc:$a: NanoCore 0x111110:$a: NanoCore 0x111150:$a: NanoCore 0x11b9a4:$a: NanoCore 0x11b9b6:$a: NanoCore 0x11b9f2:$a: NanoCore 0x127872:$a: NanoCore 0x127884:$a: NanoCore 0x1278c0:$a: NanoCore 0x17e39d:$a: NanoCore 0x17e3af:$a: NanoCore 0x17e3eb:$a: NanoCore 0x110f13:$b: ClientPlugin 0x110fb3:$b: ClientPlugin 0x111119:$b: ClientPlugin 0x111159:$b: ClientPlugin 0x11b9bf:$b: ClientPlugin
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x18f26:$x1: NanoCore.ClientPluginHost 0x765ba:$x1: NanoCore.ClientPluginHost 0x96be1:$x1: NanoCore.ClientPluginHost 0xb3c31:$x1: NanoCore.ClientPluginHost 0x18f63:$x2: IClientNetworkHost 0x765d4:$x2: IClientNetworkHost 0x96bfb:$x2: IClientNetworkHost 0xb3c5e:$x2: IClientNetworkHost 0x1ca54:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x27ada:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x18bf3:$a: NanoCore 0x18c03:$a: NanoCore 0x18cc2:$a: NanoCore 0x18cd1:$a: NanoCore 0x18ed2:$a: NanoCore 0x18ee6:$a: NanoCore 0x18f26:$a: NanoCore 0x24144:$a: NanoCore 0x24156:$a: NanoCore 0x24192:$a: NanoCore 0x473df:$a: NanoCore 0x6b761:$a: NanoCore 0x6b7bc:$a: NanoCore 0x6b82f:$a: NanoCore 0x76524:$a: NanoCore 0x7657d:$a: NanoCore 0x765ba:$a: NanoCore 0x76633:$a: NanoCore 0x76ed7:$a: NanoCore 0x76f2a:$a: NanoCore 0x76f63:$a: NanoCore
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x12ed85:$x1: NanoCore.ClientPluginHost 0x12edc2:$x2: IClientNetworkHost 0x132221:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x13cf6f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x148e3d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x19f968:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x12eb24:$a: NanoCore 0x12eb34:$a: NanoCore 0x12eb8f:$a: NanoCore 0x12eb9e:$a: NanoCore 0x12ed31:$a: NanoCore 0x12ed45:$a: NanoCore 0x12ed85:$a: NanoCore 0x1395d9:$a: NanoCore 0x1395eb:$a: NanoCore 0x139627:$a: NanoCore 0x1454a7:$a: NanoCore 0x1454b9:$a: NanoCore 0x1454f5:$a: NanoCore 0x19bfd2:$a: NanoCore 0x19bfe4:$a: NanoCore 0x19c020:$a: NanoCore 0x12eb48:$b: ClientPlugin 0x12ebe8:$b: ClientPlugin 0x12ed4e:$b: ClientPlugin 0x12ed8e:$b: ClientPlugin 0x1395f4:$b: ClientPlugin
Process Memory Space: dhcpmon.exe PID: 4800	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x13732e:$x1: NanoCore.ClientPluginHost 0x13736b:$x2: IClientNetworkHost 0x13a7ca:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x145518:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1513e6:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1a7f11:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 4800	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: dhcpmon.exe PID: 4800	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 4800	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1370cd:$a: NanoCore 0x1370dd:$a: NanoCore 0x137138:$a: NanoCore 0x137147:$a: NanoCore 0x1372da:$a: NanoCore 0x1372ee:$a: NanoCore 0x13732e:$a: NanoCore 0x141b82:$a: NanoCore 0x141b94:$a: NanoCore 0x141bd0:$a: NanoCore 0x14da50:$a: NanoCore 0x14da62:$a: NanoCore 0x14da9e:$a: NanoCore 0x1a457b:$a: NanoCore 0x1a458d:$a: NanoCore 0x1a45c9:$a: NanoCore 0x1370f1:$b: ClientPlugin 0x137191:$b: ClientPlugin 0x1372f7:$b: ClientPlugin 0x137337:$b: ClientPlugin 0x141b9d:$b: ClientPlugin
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x112a6:$x1: NanoCore.ClientPluginHost 0x38b13:$x1: NanoCore.ClientPluginHost 0x646f1:$x1: NanoCore.ClientPluginHost 0x112e3:$x2: IClientNetworkHost 0x38b2d:$x2: IClientNetworkHost 0x6470b:$x2: IClientNetworkHost 0x14dd4:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1fe5a:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10f73:$a: NanoCore 0x10f83:$a: NanoCore 0x11042:$a: NanoCore 0x11051:$a: NanoCore 0x11252:$a: NanoCore 0x11266:$a: NanoCore 0x112a6:$a: NanoCore 0x1c4c4:$a: NanoCore 0x1c4d6:$a: NanoCore 0x1c512:$a: NanoCore 0x38a7d:$a: NanoCore 0x38ad6:$a: NanoCore 0x38b13:$a: NanoCore 0x38b8c:$a: NanoCore 0x39445:$a: NanoCore 0x39498:$a: NanoCore 0x394d1:$a: NanoCore 0x39544:$a: NanoCore 0x40b16:$a: NanoCore 0x40b29:$a: NanoCore 0x40b5b:$a: NanoCore
Process Memory Space: dhcpmon.exe PID: 3832	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd6a7c:$x1: NanoCore.ClientPluginHost 0xd6ab9:$x2: IClientNetworkHost 0xd9f18:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xe4c66:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xf0b34:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x14765f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 3832	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: dhcpmon.exe PID: 3832	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 3832	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xd681b:$a: NanoCore 0xd682b:$a: NanoCore 0xd6886:$a: NanoCore 0xd6895:$a: NanoCore 0xd6a28:$a: NanoCore 0xd6a3c:$a: NanoCore 0xd6a7c:$a: NanoCore 0xe12d0:$a: NanoCore 0xe12e2:$a: NanoCore 0xe131e:$a: NanoCore 0xed19e:$a: NanoCore 0xed1b0:$a: NanoCore 0xed1ec:$a: NanoCore 0x143cc9:$a: NanoCore 0x143cdb:$a: NanoCore 0x143d17:$a: NanoCore 0xd683f:$b: ClientPlugin 0xd68df:$b: ClientPlugin 0xd6a45:$b: ClientPlugin 0xd6a85:$b: ClientPlugin 0xe12eb:$b: ClientPlugin
Process Memory Space: dhcpmon.exe PID: 5644	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1c1d1:$x1: NanoCore.ClientPluginHost 0x34adc:$x1: NanoCore.ClientPluginHost 0x5e19b:$x1: NanoCore.ClientPluginHost 0x1c20e:$x2: IClientNetworkHost 0x34af6:$x2: IClientNetworkHost 0x5e1b5:$x2: IClientNetworkHost 0x1fcff:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2ad85:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 5644	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 5644	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1be9e:$a: NanoCore 0x1beae:$a: NanoCore 0x1bf6d:$a: NanoCore 0x1bf7c:$a: NanoCore 0x1c17d:$a: NanoCore 0x1c191:$a: NanoCore 0x1c1d1:$a: NanoCore 0x273ef:$a: NanoCore 0x27401:$a: NanoCore 0x2743d:$a: NanoCore 0x34a46:$a: NanoCore 0x34a9f:$a: NanoCore 0x34adc:$a: NanoCore 0x34b55:$a: NanoCore 0x3540e:$a: NanoCore 0x35461:$a: NanoCore 0x3549a:$a: NanoCore 0x3550d:$a: NanoCore 0x3cadf:$a: NanoCore 0x3caf2:$a: NanoCore 0x3cb24:$a: NanoCore
Process Memory Space: dhcpmon.exe PID: 6992	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x19939:$x1: NanoCore.ClientPluginHost 0x35bc2:$x1: NanoCore.ClientPluginHost 0x5f7b1:$x1: NanoCore.ClientPluginHost 0x19976:$x2: IClientNetworkHost 0x35bdc:$x2: IClientNetworkHost 0x5f7cb:$x2: IClientNetworkHost 0x1d467:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x284ed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: dhcpmon.exe PID: 6992	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 6992	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x19606:$a: NanoCore 0x19616:$a: NanoCore 0x196d5:$a: NanoCore 0x196e4:$a: NanoCore 0x198e5:$a: NanoCore 0x198f9:$a: NanoCore 0x19939:$a: NanoCore 0x24b57:$a: NanoCore 0x24b69:$a: NanoCore 0x24ba5:$a: NanoCore 0x35b2c:$a: NanoCore 0x35b85:$a: NanoCore 0x35bc2:$a: NanoCore 0x35c3b:$a: NanoCore 0x364f4:$a: NanoCore 0x36547:$a: NanoCore 0x36580:$a: NanoCore 0x365f3:$a: NanoCore 0x3dbc5:$a: NanoCore 0x3dbd8:$a: NanoCore 0x3dc0a:$a: NanoCore
Click to see the 119 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.2f997bc.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.2f997bc.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
8.2.dhcpmon.exe.2e38774.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
11.2.dhcpmon.exe.399ec60.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.2.dhcpmon.exe.399ec60.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
11.2.dhcpmon.exe.399ec60.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.dhcpmon.exe.399ec60.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.2.dhcpmon.exe.3e8b78e.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5e7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d614:$x2: IClientNetworkHost
18.2.dhcpmon.exe.3e8b78e.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5e7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6c2:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d601:$s5: IClientLoggingHost
18.2.dhcpmon.exe.3e8b78e.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.2.dhcpmon.exe.3e8b78e.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d59d:$a: NanoCore 0x2d5b2:$a: NanoCore 0x2d5e7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d359:$b: ClientPlugin 0x2d374:$b: ClientPlugin
18.0.dhcpmon.exe.400000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
18.0.dhcpmon.exe.400000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
18.0.dhcpmon.exe.400000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.0.dhcpmon.exe.400000.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24188:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241b5:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24188:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25263:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241a2:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.315dc78.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3188810.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
18.2.dhcpmon.exe.3e905c4.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
18.2.dhcpmon.exe.3e905c4.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
18.2.dhcpmon.exe.3e905c4.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.2.dhcpmon.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3186a78.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3186a78.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
18.0.dhcpmon.exe.400000.10.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
18.0.dhcpmon.exe.400000.10.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
18.0.dhcpmon.exe.400000.10.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.0.dhcpmon.exe.400000.10.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24188:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241b5:$x2: IClientNetworkHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24188:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25263:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241a2:$s5: IClientLoggingHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.dhcpmon.exe.400000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.dhcpmon.exe.400000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.dhcpmon.exe.400000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.dhcpmon.exe.400000.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
11.2.dhcpmon.exe.396c040.7.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.2.dhcpmon.exe.396c040.7.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
11.2.dhcpmon.exe.396c040.7.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.dhcpmon.exe.396c040.7.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
8.2.dhcpmon.exe.3f5c040.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.3f5c040.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
8.2.dhcpmon.exe.3f5c040.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.3f5c040.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
12.2.dhcpmon.exe.3b705c4.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
12.2.dhcpmon.exe.3b705c4.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
12.2.dhcpmon.exe.3b705c4.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.3b705c4.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287b1:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287de:$x2: IClientNetworkHost
12.2.dhcpmon.exe.3b705c4.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287b1:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2988c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287cb:$s5: IClientLoggingHost
12.2.dhcpmon.exe.3b705c4.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.2b89688.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
12.2.dhcpmon.exe.2b89688.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287b1:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287de:$x2: IClientNetworkHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287b1:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2988c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287cb:$s5: IClientLoggingHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x102d1d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x102d5a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x10688d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x102a85:$a: NanoCore 0x102a95:$a: NanoCore 0x102cc9:$a: NanoCore 0x102cdd:$a: NanoCore 0x102d1d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x102ae4:$b: ClientPlugin 0x102ce6:$b: ClientPlugin 0x102d26:$b: ClientPlugin 0x1007b:$c: ProjectData 0xa71ff:$c: ProjectData 0x102c0b:$c: ProjectData 0x10a82:$d: DESCrypto 0x103612:$d: DESCrypto
18.0.dhcpmon.exe.400000.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
18.0.dhcpmon.exe.400000.12.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
18.0.dhcpmon.exe.400000.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.0.dhcpmon.exe.400000.12.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
18.0.dhcpmon.exe.400000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
18.0.dhcpmon.exe.400000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
18.0.dhcpmon.exe.400000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.0.dhcpmon.exe.400000.8.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
18.2.dhcpmon.exe.3e905c4.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287b1:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287de:$x2: IClientNetworkHost
18.2.dhcpmon.exe.3e905c4.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287b1:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2988c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287cb:$s5: IClientLoggingHost
18.2.dhcpmon.exe.3e905c4.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5e7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d614:$x2: IClientNetworkHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5e7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6c2:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d601:$s5: IClientLoggingHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d59d:$a: NanoCore 0x2d5b2:$a: NanoCore 0x2d5e7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d359:$b: ClientPlugin 0x2d374:$b: ClientPlugin
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.5910000.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.5910000.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x287b1:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287de:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x287b1:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2988c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287cb:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.2e0dbdc.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
12.2.dhcpmon.exe.3b6b78e.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5e7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d614:$x2: IClientNetworkHost
12.2.dhcpmon.exe.3b6b78e.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5e7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6c2:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d601:$s5: IClientLoggingHost
12.2.dhcpmon.exe.3b6b78e.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.3b6b78e.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d59d:$a: NanoCore 0x2d5b2:$a: NanoCore 0x2d5e7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d359:$b: ClientPlugin 0x2d374:$b: ClientPlugin
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42dad:$x1: NanoCore.ClientPluginHost 0x13593d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42dea:$x2: IClientNetworkHost 0x13597a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4691d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1394ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42b15:$a: NanoCore 0x42b25:$a: NanoCore 0x42d59:$a: NanoCore 0x42d6d:$a: NanoCore 0x42dad:$a: NanoCore 0x1356a5:$a: NanoCore 0x1356b5:$a: NanoCore 0x1358e9:$a: NanoCore 0x1358fd:$a: NanoCore 0x13593d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42b74:$b: ClientPlugin 0x42d76:$b: ClientPlugin 0x42db6:$b: ClientPlugin
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.241dc78.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.0.dhcpmon.exe.400000.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.dhcpmon.exe.400000.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.dhcpmon.exe.400000.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.dhcpmon.exe.400000.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x102d1d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x102d5a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x10688d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
18.0.dhcpmon.exe.400000.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
18.0.dhcpmon.exe.400000.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
18.0.dhcpmon.exe.400000.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.0.dhcpmon.exe.400000.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x102a85:$a: NanoCore 0x102a95:$a: NanoCore 0x102cc9:$a: NanoCore 0x102cdd:$a: NanoCore 0x102d1d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x102ae4:$b: ClientPlugin 0x102ce6:$b: ClientPlugin 0x102d26:$b: ClientPlugin 0x1007b:$c: ProjectData 0xa71ff:$c: ProjectData 0x102c0b:$c: ProjectData 0x10a82:$d: DESCrypto 0x103612:$d: DESCrypto
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
18.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
18.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
18.2.dhcpmon.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.2.dhcpmon.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.2448810.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
8.2.dhcpmon.exe.3f8ec60.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x102d1d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x102d5a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x10688d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.3f8ec60.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.3f8ec60.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x102a85:$a: NanoCore 0x102a95:$a: NanoCore 0x102cc9:$a: NanoCore 0x102cdd:$a: NanoCore 0x102d1d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x102ae4:$b: ClientPlugin 0x102ce6:$b: ClientPlugin 0x102d26:$b: ClientPlugin 0x1007b:$c: ProjectData 0xa71ff:$c: ProjectData 0x102c0b:$c: ProjectData 0x10a82:$d: DESCrypto 0x103612:$d: DESCrypto
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
8.2.dhcpmon.exe.3f8ec60.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.3f8ec60.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
8.2.dhcpmon.exe.3f8ec60.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.3f8ec60.5.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
11.2.dhcpmon.exe.2848774.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
12.0.dhcpmon.exe.400000.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.dhcpmon.exe.400000.12.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.dhcpmon.exe.400000.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.dhcpmon.exe.400000.12.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
8.2.dhcpmon.exe.3f5c040.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42dad:$x1: NanoCore.ClientPluginHost 0x13593d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42dea:$x2: IClientNetworkHost 0x13597a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4691d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1394ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.3f5c040.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.3f5c040.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42b15:$a: NanoCore 0x42b25:$a: NanoCore 0x42d59:$a: NanoCore 0x42d6d:$a: NanoCore 0x42dad:$a: NanoCore 0x1356a5:$a: NanoCore 0x1356b5:$a: NanoCore 0x1358e9:$a: NanoCore 0x1358fd:$a: NanoCore 0x13593d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42b74:$b: ClientPlugin 0x42d76:$b: ClientPlugin 0x42db6:$b: ClientPlugin
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42dad:$x1: NanoCore.ClientPluginHost 0x13593d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42dea:$x2: IClientNetworkHost 0x13597a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4691d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1394ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42b15:$a: NanoCore 0x42b25:$a: NanoCore 0x42d59:$a: NanoCore 0x42d6d:$a: NanoCore 0x42dad:$a: NanoCore 0x1356a5:$a: NanoCore 0x1356b5:$a: NanoCore 0x1358e9:$a: NanoCore 0x1358fd:$a: NanoCore 0x13593d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42b74:$b: ClientPlugin 0x42d76:$b: ClientPlugin 0x42db6:$b: ClientPlugin
11.2.dhcpmon.exe.396c040.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x42dad:$x1: NanoCore.ClientPluginHost 0x13593d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x42dea:$x2: IClientNetworkHost 0x13597a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4691d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1394ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.2.dhcpmon.exe.396c040.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.dhcpmon.exe.396c040.7.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42b15:$a: NanoCore 0x42b25:$a: NanoCore 0x42d59:$a: NanoCore 0x42d6d:$a: NanoCore 0x42dad:$a: NanoCore 0x1356a5:$a: NanoCore 0x1356b5:$a: NanoCore 0x1358e9:$a: NanoCore 0x1358fd:$a: NanoCore 0x13593d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42b74:$b: ClientPlugin 0x42d76:$b: ClientPlugin 0x42db6:$b: ClientPlugin
11.2.dhcpmon.exe.281dbdc.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.dhcpmon.exe.3b74bed.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24188:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241b5:$x2: IClientNetworkHost
12.2.dhcpmon.exe.3b74bed.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24188:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25263:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241a2:$s5: IClientLoggingHost
12.2.dhcpmon.exe.3b74bed.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
18.2.dhcpmon.exe.2ea9688.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
18.2.dhcpmon.exe.2ea9688.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5e7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d614:$x2: IClientNetworkHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5e7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6c2:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d601:$s5: IClientLoggingHost
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d59d:$a: NanoCore 0x2d5b2:$a: NanoCore 0x2d5e7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d359:$b: ClientPlugin 0x2d374:$b: ClientPlugin
18.2.dhcpmon.exe.3e94bed.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24188:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x241b5:$x2: IClientNetworkHost
18.2.dhcpmon.exe.3e94bed.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24188:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25263:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x241a2:$s5: IClientLoggingHost
18.2.dhcpmon.exe.3e94bed.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.dhcpmon.exe.400000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.dhcpmon.exe.400000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.dhcpmon.exe.400000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.dhcpmon.exe.400000.8.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.0.dhcpmon.exe.400000.10.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.0.dhcpmon.exe.400000.10.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.0.dhcpmon.exe.400000.10.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.0.dhcpmon.exe.400000.10.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
11.2.dhcpmon.exe.399ec60.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x102d1d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x102d5a:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x10688d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.2.dhcpmon.exe.399ec60.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.dhcpmon.exe.399ec60.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x102a85:$a: NanoCore 0x102a95:$a: NanoCore 0x102cc9:$a: NanoCore 0x102cdd:$a: NanoCore 0x102d1d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x102ae4:$b: ClientPlugin 0x102ce6:$b: ClientPlugin 0x102d26:$b: ClientPlugin 0x1007b:$c: ProjectData 0xa71ff:$c: ProjectData 0x102c0b:$c: ProjectData 0x10a82:$d: DESCrypto 0x103612:$d: DESCrypto
8.2.dhcpmon.exe.3de9930.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x18289d:$x1: NanoCore.ClientPluginHost 0x1b54bd:$x1: NanoCore.ClientPluginHost 0x2a804d:$x1: NanoCore.ClientPluginHost 0x1828da:$x2: IClientNetworkHost 0x1b54fa:$x2: IClientNetworkHost 0x2a808a:$x2: IClientNetworkHost 0x18640d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b902d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2abbbd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.dhcpmon.exe.3de9930.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.dhcpmon.exe.3de9930.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182605:$a: NanoCore 0x182615:$a: NanoCore 0x182849:$a: NanoCore 0x18285d:$a: NanoCore 0x18289d:$a: NanoCore 0x1b5225:$a: NanoCore 0x1b5235:$a: NanoCore 0x1b5469:$a: NanoCore 0x1b547d:$a: NanoCore 0x1b54bd:$a: NanoCore 0x2a7db5:$a: NanoCore 0x2a7dc5:$a: NanoCore 0x2a7ff9:$a: NanoCore 0x2a800d:$a: NanoCore 0x2a804d:$a: NanoCore 0x182664:$b: ClientPlugin 0x182866:$b: ClientPlugin 0x1828a6:$b: ClientPlugin 0x1b5284:$b: ClientPlugin 0x1b5486:$b: ClientPlugin 0x1b54c6:$b: ClientPlugin
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x18289d:$x1: NanoCore.ClientPluginHost 0x1b54bd:$x1: NanoCore.ClientPluginHost 0x2a804d:$x1: NanoCore.ClientPluginHost 0x1828da:$x2: IClientNetworkHost 0x1b54fa:$x2: IClientNetworkHost 0x2a808a:$x2: IClientNetworkHost 0x18640d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b902d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2abbbd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182605:$a: NanoCore 0x182615:$a: NanoCore 0x182849:$a: NanoCore 0x18285d:$a: NanoCore 0x18289d:$a: NanoCore 0x1b5225:$a: NanoCore 0x1b5235:$a: NanoCore 0x1b5469:$a: NanoCore 0x1b547d:$a: NanoCore 0x1b54bd:$a: NanoCore 0x2a7db5:$a: NanoCore 0x2a7dc5:$a: NanoCore 0x2a7ff9:$a: NanoCore 0x2a800d:$a: NanoCore 0x2a804d:$a: NanoCore 0x182664:$b: ClientPlugin 0x182866:$b: ClientPlugin 0x1828a6:$b: ClientPlugin 0x1b5284:$b: ClientPlugin 0x1b5486:$b: ClientPlugin 0x1b54c6:$b: ClientPlugin
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x18289d:$x1: NanoCore.ClientPluginHost 0x1b54bd:$x1: NanoCore.ClientPluginHost 0x2a804d:$x1: NanoCore.ClientPluginHost 0x1828da:$x2: IClientNetworkHost 0x1b54fa:$x2: IClientNetworkHost 0x2a808a:$x2: IClientNetworkHost 0x18640d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b902d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2abbbd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182605:$a: NanoCore 0x182615:$a: NanoCore 0x182849:$a: NanoCore 0x18285d:$a: NanoCore 0x18289d:$a: NanoCore 0x1b5225:$a: NanoCore 0x1b5235:$a: NanoCore 0x1b5469:$a: NanoCore 0x1b547d:$a: NanoCore 0x1b54bd:$a: NanoCore 0x2a7db5:$a: NanoCore 0x2a7dc5:$a: NanoCore 0x2a7ff9:$a: NanoCore 0x2a800d:$a: NanoCore 0x2a804d:$a: NanoCore 0x182664:$b: ClientPlugin 0x182866:$b: ClientPlugin 0x1828a6:$b: ClientPlugin 0x1b5284:$b: ClientPlugin 0x1b5486:$b: ClientPlugin 0x1b54c6:$b: ClientPlugin
11.2.dhcpmon.exe.37f9930.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x18289d:$x1: NanoCore.ClientPluginHost 0x1b54bd:$x1: NanoCore.ClientPluginHost 0x2a804d:$x1: NanoCore.ClientPluginHost 0x1828da:$x2: IClientNetworkHost 0x1b54fa:$x2: IClientNetworkHost 0x2a808a:$x2: IClientNetworkHost 0x18640d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b902d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x2abbbd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.2.dhcpmon.exe.37f9930.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.2.dhcpmon.exe.37f9930.8.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x182605:$a: NanoCore 0x182615:$a: NanoCore 0x182849:$a: NanoCore 0x18285d:$a: NanoCore 0x18289d:$a: NanoCore 0x1b5225:$a: NanoCore 0x1b5235:$a: NanoCore 0x1b5469:$a: NanoCore 0x1b547d:$a: NanoCore 0x1b54bd:$a: NanoCore 0x2a7db5:$a: NanoCore 0x2a7dc5:$a: NanoCore 0x2a7ff9:$a: NanoCore 0x2a800d:$a: NanoCore 0x2a804d:$a: NanoCore 0x182664:$b: ClientPlugin 0x182866:$b: ClientPlugin 0x1828a6:$b: ClientPlugin 0x1b5284:$b: ClientPlugin 0x1b5486:$b: ClientPlugin 0x1b54c6:$b: ClientPlugin
Click to see the 238 entries

Sigma Overview

AV Detection:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe, ProcessId: 6296, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud:

Sigma detected: NanoCore

Show sources

Source: File created

System Summary:

Sigma detected: Suspicius Add Task From User AppData Temp

Show sources

Source: Process started

Author: frack113: Data: Command: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp, CommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe, ParentImage: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe, ParentProcessId: 6296, ProcessCommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp, ProcessId: 4544

Stealing of Sensitive Information:

Sigma detected: NanoCore

Show sources

Source: File created

Remote Access Functionality:

Sigma detected: NanoCore

Show sources

Source: File created

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Virustotal: Detection: 33%	Perma Link
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Metadefender: Detection: 28%	Perma Link
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	ReversingLabs: Detection: 48%

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Metadefender: Detection: 28%			Perma Link
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	ReversingLabs: Detection: 48%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b74bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e94bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR

Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 18.0.dhcpmon.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.2.dhcpmon.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack	Avira: Label: TR/NanoCore.fadte
Source: 18.0.dhcpmon.exe.400000.10.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.dhcpmon.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 18.0.dhcpmon.exe.400000.12.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 18.0.dhcpmon.exe.400000.8.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 18.0.dhcpmon.exe.400000.6.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.dhcpmon.exe.400000.6.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 18.2.dhcpmon.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.dhcpmon.exe.400000.12.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.dhcpmon.exe.400000.10.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.0.dhcpmon.exe.400000.8.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: PermissionSetAttribu.pdb source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp

Networking:

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: kashbilly.ddns.net

Source: global traffic

TCP traffic: 192.168.2.6:49757 -> 197.211.59.104:6060

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://ati.amd.com/developer/compressonator.html
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://developer.nvidia.com/object/dds_thumbnail_viewer.html
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://developer.nvidia.com/object/photoshop_dds_plugins.html
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	String found in binary or memory: http://developer.nvidia.com/object/photoshop_dds_plugins.htmlyhttp://developer.nvidia.com/object/dds
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, dhcpmon.exe, 0000000B.00000002.440433881.0000000006CA0000.00000004.00020000.sdmp	String found in binary or memory: http://igaeditor.sourceforge.net/
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://igaeditor.sourceforge.net/latest.txt
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	String found in binary or memory: http://igaeditor.sourceforge.net/ohttp://www.totalbf2142.com/forums/showthread.php?t=5342Whttp://iga
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://igaeditor.sourceforge.net/wiki/
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.379123716.0000000007C20000.00000004.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.412733612.0000000006B30000.00000004.00020000.sdmp, dhcpmon.exe, 00000008.00000002.418987180.0000000007370000.00000004.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.440433881.0000000006CA0000.00000004.00020000.sdmp	String found in binary or memory: http://micolous.id.au/
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://micolous.id.au/projects/bf21
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.379123716.0000000007C20000.00000004.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.412733612.0000000006B30000.00000004.00020000.sdmp, dhcpmon.exe, 00000008.00000002.418987180.0000000007370000.00000004.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.440433881.0000000006CA0000.00000004.00020000.sdmp	String found in binary or memory: http://micolous.id.au/projects/bf2142/
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	String found in binary or memory: http://micolous.id.au/projects/bf2142/.
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://registry.gimp.org/plugin?id=4816
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	String found in binary or memory: http://www.gimp.org/windows/
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	String found in binary or memory: http://www.pcgamingboards.com/smf/index.php?topic=129.msg279#msg279
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://www.radgametools.com/bnkdown.htm
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: http://www.totalbf2142.com/forums/showthread.php?t=5342
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: https://sourceforge.net/project/showfiles.php?group_id=181663
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	String found in binary or memory: https://sourceforge.net/project/showfiles.php?group_id=181663Mhttp://igaeditor.sourceforge.net/wiki/
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	String found in binary or memory: https://sourceforge.net/svn/?group_id=181663

Source: unknown

DNS traffic detected: queries for: kashbilly.ddns.net

Source: dhcpmon.exe, 00000008.00000002.414092694.0000000001098000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b74bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e94bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.2f997bc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.3e905c4.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3186a78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.dhcpmon.exe.3b705c4.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.3b705c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.2b89688.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.2.dhcpmon.exe.3e905c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.5910000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.dhcpmon.exe.3b74bed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 18.2.dhcpmon.exe.2ea9688.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 18.2.dhcpmon.exe.3e94bed.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.630554205.0000000005910000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.2f997bc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.2f997bc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.2.dhcpmon.exe.3e905c4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.3e905c4.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3186a78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3186a78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.dhcpmon.exe.3b705c4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.3b705c4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.dhcpmon.exe.3b705c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.3b705c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.dhcpmon.exe.2b89688.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.2b89688.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.2.dhcpmon.exe.3e905c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.3e905c4.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.5910000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.5910000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.dhcpmon.exe.3b74bed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.dhcpmon.exe.3b74bed.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 18.2.dhcpmon.exe.2ea9688.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.2ea9688.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 18.2.dhcpmon.exe.3e94bed.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 18.2.dhcpmon.exe.3e94bed.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.630554205.0000000005910000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.630554205.0000000005910000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_0310C3F4
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_0310E9F8
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_0310E9E8
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_076EBFE8
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_076E3568
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_076E35C0
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_076E35B0
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_0161E471
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_0161E480
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_0161BBD4
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_05796550
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_05793E30
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_0579C6F0
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_0579D308
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_05794A50
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_0579D640
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_05794B08
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_0579D3C6
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 2_2_06BE0040
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_0492C3F4
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_0492E9F2
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_0492E9F8
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_066BBFE8
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_066B3569
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_066B35C0
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_066B35B0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_0133C3F4
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_0133E9F4
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_0133E9F8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_053E7F98
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_053E7F89
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_053E6988
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_0753BFE8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_07533569
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_075335C0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_075335B0
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 9_2_0123E471
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 9_2_0123E480
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 9_2_0123BBD4

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374253790.0000000000E24000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePermissionSetAttribu.exeH vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUI.dllF vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368688896.0000000000DF4000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePermissionSetAttribu.exeH vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.630982055.0000000006860000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.404702459.00000000001D4000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePermissionSetAttribu.exeH vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUI.dllF vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.420068237.0000000000BF4000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePermissionSetAttribu.exeH vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.420894807.000000000125A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dhcpmon.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dhcpmon.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Virustotal: Detection: 33%
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Metadefender: Detection: 28%
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe	ReversingLabs: Detection: 48%

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

File read: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Jump to behavior

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe "C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe"
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe "C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe" 0
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp3019.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe"
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp3019.tmp
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NEW PRICE ENQUIRY FROM PHILLIPINES.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

File created: C:\Users\user\AppData\Local\Temp\tmp1E56.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@22/8@7/1

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp

Binary or memory string: INSERT INTO [content] ([active], [activate], [expire], [dayparts], [contentType], [descriptor], [size], [viewcount], [viewlimit], [displayafter], [props], [data]) VALUES (@active, @activate, @expire, @dayparts, @contentType, @descriptor, @size, @viewcount, @viewlimit, @displayafter, @props, @data); SELECT last_insert_rowid() AS contentId;

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{51e297f7-7758-4d32-86af-0aafa20a3f56}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4712:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5396:120:WilError_01

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, mee/Keg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d60000.0.unpack, mee/Keg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d60000.0.unpack, mee/Keg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: dhcpmon.exe.2.dr, mee/Keg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.1.unpack, mee/Keg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.3.unpack, mee/Keg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.7.unpack, mee/Keg.cs	Cryptographic APIs: 'CreateDecryptor'

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d60000.0.unpack, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d60000.0.unpack, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: dhcpmon.exe.2.dr, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.1.unpack, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.3.unpack, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.7.unpack, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.11.unpack, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.1.unpack, GZ/v4.cs	.Net Code: OFU System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d60000.0.unpack, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d60000.0.unpack, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: dhcpmon.exe.2.dr, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.1.unpack, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.3.unpack, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.7.unpack, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.11.unpack, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.d30000.1.unpack, mee/Keg.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 0_2_076E61E9 push ebx; iretd
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_066B8E8B push es; ret
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_066B8B7F push es; iretd
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Code function: 5_2_066B61E9 push ebx; iretd
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 8_2_075361E9 push ebx; iretd

Source: initial sample	Static PE information: section name: .text entropy: 7.78570516551
Source: initial sample	Static PE information: section name: .text entropy: 7.78570516551

Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

File opened: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe:Zone.Identifier read attributes | delete

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 8.2.dhcpmon.exe.2e38774.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.315dc78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3188810.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.2e0dbdc.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.241dc78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.2448810.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.2848774.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.281dbdc.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.405885407.00000000023F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.415561117.0000000002DE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.375378918.0000000003131000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.375378918.0000000003131000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.405885407.00000000023F1000.00000004.00000001.sdmp, dhcpmon.exe, 00000008.00000002.415561117.0000000002DE1000.00000004.00000001.sdmp, dhcpmon.exe, 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.375378918.0000000003131000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.405885407.00000000023F1000.00000004.00000001.sdmp, dhcpmon.exe, 00000008.00000002.415561117.0000000002DE1000.00000004.00000001.sdmp, dhcpmon.exe, 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe TID: 772	Thread sleep time: -39926s >= -30000s
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe TID: 6224	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe TID: 5888	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe TID: 6420	Thread sleep time: -38463s >= -30000s
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe TID: 5104	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4400	Thread sleep time: -35164s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5964	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe TID: 6636	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5024	Thread sleep time: -33769s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5596	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 6704	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 6824	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Window / User API: threadDelayed 6516
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Window / User API: threadDelayed 2954
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Window / User API: foregroundWindowGot 874

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 39926
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 38463
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 35164
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 33769
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: dhcpmon.exe, 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: dhcpmon.exe, 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.627007908.00000000012E5000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: dhcpmon.exe, 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp3019.tmp
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Process created: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628991392.00000000031C7000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629899402.0000000003722000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629391684.00000000032A7000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629737178.0000000003592000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629584039.00000000033FD000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.630799975.00000000065EB000.00000004.00000010.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629242696.0000000003259000.00000004.00000001.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.631357745.00000000070ED000.00000004.00000010.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.631186845.0000000006BBC000.00000004.00000010.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.630964365.000000000685D000.00000004.00000010.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629433411.00000000032B4000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628490640.0000000001C40000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628490640.0000000001C40000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628490640.0000000001C40000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628490640.0000000001C40000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b74bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e94bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e8b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a4bed.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f84bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b705c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.359ec60.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e905c4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f7b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.41a05c4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.3f805c4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b6b78e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6704629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.356c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f8ec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3f5c040.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42ac040.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.396c040.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dhcpmon.exe.3b74bed.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.42dec60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.419b78e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.3e94bed.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.399ec60.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.dhcpmon.exe.3de9930.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.4139930.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.33f9930.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dhcpmon.exe.37f9930.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 4800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 3832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6992, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Process Injection12	Masquerading2	Input Capture21	Security Software Discovery21	Remote Services	Input Capture21	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion21	Security Account Manager	Virtualization/Sandbox Evasion21	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	System Information Discovery12	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol11	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing23	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
NEW PRICE ENQUIRY FROM PHILLIPINES.exe	34%	Virustotal		Browse
NEW PRICE ENQUIRY FROM PHILLIPINES.exe	29%	Metadefender		Browse
NEW PRICE ENQUIRY FROM PHILLIPINES.exe	49%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	29%	Metadefender		Browse
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	49%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Download
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
18.0.dhcpmon.exe.400000.4.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.2.dhcpmon.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.6700000.8.unpack	100%	Avira	TR/NanoCore.fadte	Download File
18.0.dhcpmon.exe.400000.10.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.dhcpmon.exe.400000.4.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
18.0.dhcpmon.exe.400000.12.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
18.0.dhcpmon.exe.400000.8.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
9.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.10.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
2.2.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
18.0.dhcpmon.exe.400000.6.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.8.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.dhcpmon.exe.400000.6.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
18.2.dhcpmon.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
2.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.4.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.dhcpmon.exe.400000.12.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.6.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
9.0.NEW PRICE ENQUIRY FROM PHILLIPINES.exe.400000.12.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.dhcpmon.exe.400000.10.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.0.dhcpmon.exe.400000.8.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://micolous.id.au/projects/bf21	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.pcgamingboards.com/smf/index.php?topic=129.msg279#msg279	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.totalbf2142.com/forums/showthread.php?t=5342	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://micolous.id.au/projects/bf2142/.	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://micolous.id.au/	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://micolous.id.au/projects/bf2142/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kashbilly.ddns.net	197.211.59.104	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://igaeditor.sourceforge.net/wiki/	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://ati.amd.com/developer/compressonator.html	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://www.fontbureau.com/designers/?	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
https://sourceforge.net/project/showfiles.php?group_id=181663Mhttp://igaeditor.sourceforge.net/wiki/	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://igaeditor.sourceforge.net/	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, dhcpmon.exe, 0000000B.00000002.440433881.0000000006CA0000.00000004.00020000.sdmp	false		high
http://www.fontbureau.com/designers?	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://igaeditor.sourceforge.net/latest.txt	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://www.radgametools.com/bnkdown.htm	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://developer.nvidia.com/object/dds_thumbnail_viewer.html	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://micolous.id.au/projects/bf21	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.pcgamingboards.com/smf/index.php?topic=129.msg279#msg279	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://igaeditor.sourceforge.net/ohttp://www.totalbf2142.com/forums/showthread.php?t=5342Whttp://iga	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	false		high
http://www.goodfont.co.kr	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.gimp.org/windows/	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	false		high
http://www.carterandcone.coml	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.totalbf2142.com/forums/showthread.php?t=5342	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false	Avira URL Cloud: safe	unknown
http://registry.gimp.org/plugin?id=4816	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
https://sourceforge.net/svn/?group_id=181663	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://www.jiyu-kobo.co.jp/	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://sourceforge.net/project/showfiles.php?group_id=181663	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://www.fontbureau.com/designers8	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://micolous.id.au/projects/bf2142/.	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://developer.nvidia.com/object/photoshop_dds_plugins.html	NEW PRICE ENQUIRY FROM PHILLIPINES.exe	false		high
http://www.zhongyicts.com.cn	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://developer.nvidia.com/object/photoshop_dds_plugins.htmlyhttp://developer.nvidia.com/object/dds	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.374107152.0000000000D62000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000002.00000000.368593122.0000000000D32000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000000.388098487.0000000000112000.00000002.00020000.sdmp, dhcpmon.exe, 00000008.00000002.412733612.0000000000942000.00000002.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000009.00000000.402338906.0000000000B32000.00000002.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.434374416.0000000000282000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.430902824.0000000000762000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000000.415826447.00000000003C2000.00000002.00020000.sdmp, dhcpmon.exe, 00000011.00000000.420349952.0000000000172000.00000002.00020000.sdmp, dhcpmon.exe, 00000012.00000000.429703752.0000000000A42000.00000002.00020000.sdmp	false		high
http://micolous.id.au/	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.379123716.0000000007C20000.00000004.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.412733612.0000000006B30000.00000004.00020000.sdmp, dhcpmon.exe, 00000008.00000002.418987180.0000000007370000.00000004.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.440433881.0000000006CA0000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.378302484.00000000071F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://micolous.id.au/projects/bf2142/	NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000000.00000002.379123716.0000000007C20000.00000004.00020000.sdmp, NEW PRICE ENQUIRY FROM PHILLIPINES.exe, 00000005.00000002.412733612.0000000006B30000.00000004.00020000.sdmp, dhcpmon.exe, 00000008.00000002.418987180.0000000007370000.00000004.00020000.sdmp, dhcpmon.exe, 0000000B.00000002.440433881.0000000006CA0000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
197.211.59.104	kashbilly.ddns.net	Nigeria		37148	globacom-asNG	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	552509
Start date:	13.01.2022
Start time:	13:16:18
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 2s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@22/8@7/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 1% (good quality ratio 0.8%) Quality average: 60.1% Quality standard deviation: 34.3%
HCA Information:	Successful, ratio: 96% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:17:30	API Interceptor	907x Sleep call for process: NEW PRICE ENQUIRY FROM PHILLIPINES.exe modified
13:17:38	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
13:17:39	Task Scheduler	Run new task: DHCP Monitor path: "C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe" s>$(Arg0)
13:17:42	Task Scheduler	Run new task: DHCP Monitor Task path: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" s>$(Arg0)
13:17:45	API Interceptor	2x Sleep call for process: dhcpmon.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Download File
Process:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	784384
Entropy (8bit):	7.771015792978407
Encrypted:	false
SSDEEP:	12288:jOi+lUcXEM6qtPn8tbobGFuWWBJxMDL08n1bimg9jnwHF6KmB5I:6i8XE+P8tb5uWWBM30UbejnsGBW
MD5:	CA0D3CA986E592EC436052F747F833C0
SHA1:	8BDB8EBEA5444C42C75C0B30AC8628D06C6CBCE0
SHA-256:	5E4CCF3D7A2885AB1F1CE83B855EC6F8B771B1731FAD4807F8D57B250A5505AD
SHA-512:	87B8DDE119068E43BEF447A59523565291392F949AFFA3F5F17713A9FCFD0D7C6F466D0E1C0D0F01F8B779A0753279A291C3CB4CA6E604EFB54E390896FD26B3
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 49%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3.a................................. ... ....@.. ....................................@.....................................K....@..L....................`......Q................................................ ............... ..H............text........ ...................... ..`.sdata....... ......................@....rsrc...L....@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NEW PRICE ENQUIRY FROM PHILLIPINES.exe.log Download File
Process:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1310
Entropy (8bit):	5.345651901398759
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE47mE4Ko88:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKz6
MD5:	D918C6A765EDB90D2A227FE23A3FEC98
SHA1:	8BA802AD8D740F114783F0DADC407CBFD2A209B3
SHA-256:	AB0E9F716E31502A4C6786575C5E64DFD9D24AF99056BBE2640A2FA322CFF4D6
SHA-512:	A937ABD8294BB32A612F8B3A376C94111D688379F0A4DB9FAA2FCEB71C25E18D621EEBCFDA5706B71C8473A4F38D8B3C4005D1589B564F9B1C9C441B6D337814
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1310
Entropy (8bit):	5.345651901398759
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE47mE4Ko88:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKz6
MD5:	D918C6A765EDB90D2A227FE23A3FEC98
SHA1:	8BA802AD8D740F114783F0DADC407CBFD2A209B3
SHA-256:	AB0E9F716E31502A4C6786575C5E64DFD9D24AF99056BBE2640A2FA322CFF4D6
SHA-512:	A937ABD8294BB32A612F8B3A376C94111D688379F0A4DB9FAA2FCEB71C25E18D621EEBCFDA5706B71C8473A4F38D8B3C4005D1589B564F9B1C9C441B6D337814
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Temp\tmp1E56.tmp Download File
Process:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1327
Entropy (8bit):	5.13500670090371
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0VC0xtn:cbk4oL600QydbQxIYODOLedq3Z0j
MD5:	552FA7AF5F278BF5AC6355B61EFF095D
SHA1:	DD4F276FA31AEB75DE477977A807CEE673B5560A
SHA-256:	94E06F5F5470FA4BDC3EB130222C8352A763C2CEC568029C89808427C979A88A
SHA-512:	5E3ABBDDBCA04376DDF72301BDE566A09543CE9D0DF4A2B5EE69AA755FFF151662E2013DAFEEDDEC722D23E1E23F90DAA36B0CDF8D0D7222296A2D2027FBD9D8
Malicious:	true
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Local\Temp\tmp3019.tmp Download File
Process:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1310
Entropy (8bit):	5.109425792877704
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0R3xtn:cbk4oL600QydbQxIYODOLedq3S3j
MD5:	5C2F41CFC6F988C859DA7D727AC2B62A
SHA1:	68999C85FC7E37BAB9216E0099836D40D4545C1C
SHA-256:	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
SHA-512:	B5DA5DA378D038AFBF8A7738E47921ED39F9B726E2CAA2993D915D9291A3322F94EFE8CCA6E7AD678A670DB19926B22B20E5028460FCC89CEA7F6635E7557334
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:n78:g
MD5:	4FAF345031681B7C40273BC270C99E93
SHA1:	6660712EC422C5B5B9D93EB34CD741DA8316E92B
SHA-256:	4BC0DAC6D0EFDF3534421E795FABFC7943B0ACCC6ECCF113DEFBBD5EA9D7FF54
SHA-512:	6B9B03BE05E6804C27D953E6B57317090F4874E7E545442BB04608BEBB6970EBB22079809FCDF9CF15FB4825373CA2398E6D7757CF5349CD836A47AA65BC05D2
Malicious:	true
Reputation:	unknown
Preview:	M.=....H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat Download File
Process:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.683114454101657
Encrypted:	false
SSDEEP:	3:oNN2+WrHk2yJn:oNN2RY2Y
MD5:	E26B66631E3B80974878501C3F4E3923
SHA1:	8F9E67EF46D390D95BC032028B6D3C3C66F02504
SHA-256:	09DC45D6D6EEE1813B8F6FD9F73632C6FD99E6E1C5AD63FCF024FC48BEBE2342
SHA-512:	BCC92B9669351D76C9AD44393BD52269DF2C033B80D5FA2B6902D72EAD8FEFCF931B8D3B64FB5B18ABDEB9795FD7565DE68E2596E513BDA1F2C79C4A8BAD3612
Malicious:	false
Reputation:	unknown
Preview:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.771015792978407
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	NEW PRICE ENQUIRY FROM PHILLIPINES.exe
File size:	784384
MD5:	ca0d3ca986e592ec436052f747f833c0
SHA1:	8bdb8ebea5444c42c75c0b30ac8628d06c6cbce0
SHA256:	5e4ccf3d7a2885ab1f1ce83b855ec6f8b771b1731fad4807f8d57b250a5505ad
SHA512:	87b8dde119068e43bef447a59523565291392f949affa3f5f17713a9fcfd0d7c6f466d0e1c0d0f01f8b779a0753279a291c3cb4ca6e604efb54e390896fd26b3
SSDEEP:	12288:jOi+lUcXEM6qtPn8tbobGFuWWBJxMDL08n1bimg9jnwHF6KmB5I:6i8XE+P8tb5uWWBM30UbejnsGBW
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3.a................................. ... ....@.. ....................................@................................

Static PE Info

General
Entrypoint:	0x4c06ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61DE33C2 [Wed Jan 12 01:49:54 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc06a0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x54c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc0651	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xbe6f4	0xbe800	False	0.887363383776	data	7.78570516551	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.sdata	0xc2000	0x204	0x400	False	0.458984375	data	4.099059951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xc4000	0x54c	0x600	False	0.341145833333	data	2.76865116557	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc6000	0xc	0x200	False	0.041015625	data	0.0776331623432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xc40e8	0xb0	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xc4198	0x14	data
RT_VERSION	0xc41ac	0x3a0	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright micolous 2006-2007
Assembly Version	0.1.6.0
InternalName	PermissionSetAttribu.exe
FileVersion	0.1.6.0
CompanyName	micolous
LegalTrademarks
Comments
ProductName	IGA Ad Cache Editor
ProductVersion	0.1.6.0
FileDescription	IGA Ad Cache Editor
OriginalFilename	PermissionSetAttribu.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/13/22-13:17:42.583459	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	64267	8.8.8.8	192.168.2.6
01/13/22-13:17:59.424978	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	60342	8.8.8.8	192.168.2.6
01/13/22-13:18:51.386646	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	54982	8.8.8.8	192.168.2.6
01/13/22-13:19:10.154501	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	50010	8.8.8.8	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2022 13:17:42.602291107 CET	49757	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:17:45.600858927 CET	49757	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:17:51.617057085 CET	49757	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:17:59.467313051 CET	49760	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:02.477304935 CET	49760	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:08.477777958 CET	49760	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:16.771198988 CET	49767	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:19.931900024 CET	49767	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:25.932369947 CET	49767	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:33.630498886 CET	49812	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:36.730123997 CET	49812	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:42.730626106 CET	49812	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:51.395036936 CET	49820	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:18:54.403465986 CET	49820	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:19:00.422612906 CET	49820	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:19:10.156089067 CET	49847	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:19:13.152012110 CET	49847	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:19:19.168152094 CET	49847	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:19:28.224725008 CET	49849	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:19:31.231589079 CET	49849	6060	192.168.2.6	197.211.59.104
Jan 13, 2022 13:19:37.233083963 CET	49849	6060	192.168.2.6	197.211.59.104

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2022 13:17:42.564188957 CET	64267	53	192.168.2.6	8.8.8.8
Jan 13, 2022 13:17:42.583458900 CET	53	64267	8.8.8.8	192.168.2.6
Jan 13, 2022 13:17:59.405607939 CET	60342	53	192.168.2.6	8.8.8.8
Jan 13, 2022 13:17:59.424978018 CET	53	60342	8.8.8.8	192.168.2.6
Jan 13, 2022 13:18:16.749871969 CET	58384	53	192.168.2.6	8.8.8.8
Jan 13, 2022 13:18:16.769443035 CET	53	58384	8.8.8.8	192.168.2.6
Jan 13, 2022 13:18:33.609488964 CET	50339	53	192.168.2.6	8.8.8.8
Jan 13, 2022 13:18:33.628575087 CET	53	50339	8.8.8.8	192.168.2.6
Jan 13, 2022 13:18:51.365160942 CET	54982	53	192.168.2.6	8.8.8.8
Jan 13, 2022 13:18:51.386646032 CET	53	54982	8.8.8.8	192.168.2.6
Jan 13, 2022 13:19:10.133548021 CET	50010	53	192.168.2.6	8.8.8.8
Jan 13, 2022 13:19:10.154500961 CET	53	50010	8.8.8.8	192.168.2.6
Jan 13, 2022 13:19:28.203470945 CET	62116	53	192.168.2.6	8.8.8.8
Jan 13, 2022 13:19:28.220710039 CET	53	62116	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 13, 2022 13:17:42.564188957 CET	192.168.2.6	8.8.8.8	0x2e71	Standard query (0)	kashbilly.ddns.net	A (IP address)	IN (0x0001)
Jan 13, 2022 13:17:59.405607939 CET	192.168.2.6	8.8.8.8	0x6c08	Standard query (0)	kashbilly.ddns.net	A (IP address)	IN (0x0001)
Jan 13, 2022 13:18:16.749871969 CET	192.168.2.6	8.8.8.8	0xe1a1	Standard query (0)	kashbilly.ddns.net	A (IP address)	IN (0x0001)
Jan 13, 2022 13:18:33.609488964 CET	192.168.2.6	8.8.8.8	0xc4c4	Standard query (0)	kashbilly.ddns.net	A (IP address)	IN (0x0001)
Jan 13, 2022 13:18:51.365160942 CET	192.168.2.6	8.8.8.8	0x37c9	Standard query (0)	kashbilly.ddns.net	A (IP address)	IN (0x0001)
Jan 13, 2022 13:19:10.133548021 CET	192.168.2.6	8.8.8.8	0x6a08	Standard query (0)	kashbilly.ddns.net	A (IP address)	IN (0x0001)
Jan 13, 2022 13:19:28.203470945 CET	192.168.2.6	8.8.8.8	0x1b92	Standard query (0)	kashbilly.ddns.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jan 13, 2022 13:17:42.583458900 CET	8.8.8.8	192.168.2.6	0x2e71	No error (0)	kashbilly.ddns.net	197.211.59.104	A (IP address)	IN (0x0001)
Jan 13, 2022 13:17:59.424978018 CET	8.8.8.8	192.168.2.6	0x6c08	No error (0)	kashbilly.ddns.net	197.211.59.104	A (IP address)	IN (0x0001)
Jan 13, 2022 13:18:16.769443035 CET	8.8.8.8	192.168.2.6	0xe1a1	No error (0)	kashbilly.ddns.net	197.211.59.104	A (IP address)	IN (0x0001)
Jan 13, 2022 13:18:33.628575087 CET	8.8.8.8	192.168.2.6	0xc4c4	No error (0)	kashbilly.ddns.net	197.211.59.104	A (IP address)	IN (0x0001)
Jan 13, 2022 13:18:51.386646032 CET	8.8.8.8	192.168.2.6	0x37c9	No error (0)	kashbilly.ddns.net	197.211.59.104	A (IP address)	IN (0x0001)
Jan 13, 2022 13:19:10.154500961 CET	8.8.8.8	192.168.2.6	0x6a08	No error (0)	kashbilly.ddns.net	197.211.59.104	A (IP address)	IN (0x0001)
Jan 13, 2022 13:19:28.220710039 CET	8.8.8.8	192.168.2.6	0x1b92	No error (0)	kashbilly.ddns.net	197.211.59.104	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 976 Parent PID: 4756

General

Start time:	13:17:22
Start date:	13/01/2022
Path:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe"
Imagebase:	0xd60000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.376963060.0000000004139000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.375378918.0000000003131000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6296 Parent PID: 976

General

Start time:	13:17:30
Start date:	13/01/2022
Path:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Imagebase:	0xd30000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000000.372599487.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000000.371642803.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000000.372095812.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000002.621084177.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.628691337.0000000003151000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000002.629967529.0000000004199000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.630554205.0000000005910000.00000004.00020000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000002.00000002.630554205.0000000005910000.00000004.00020000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.630910643.0000000006700000.00000004.00020000.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000000.371099003.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: schtasks.exe PID: 4544 Parent PID: 6296

General

Start time:	13:17:35
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp1E56.tmp
Imagebase:	0xa40000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 4712 Parent PID: 4544

General

Start time:	13:17:37
Start date:	13/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6384 Parent PID: 936

General

Start time:	13:17:39
Start date:	13/01/2022
Path:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe" 0
Imagebase:	0x110000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000005.00000002.405885407.00000000023F1000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000005.00000002.407251723.00000000033F9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: schtasks.exe PID: 5096 Parent PID: 6296

General

Start time:	13:17:40
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp3019.tmp
Imagebase:	0xa40000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 5396 Parent PID: 5096

General

Start time:	13:17:41
Start date:	13/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: dhcpmon.exe PID: 4800 Parent PID: 936

General

Start time:	13:17:42
Start date:	13/01/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0
Imagebase:	0x940000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000008.00000002.415561117.0000000002DE1000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000008.00000002.416144322.0000000003DE9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 29%, Metadefender, Browse Detection: 49%, ReversingLabs
Reputation:	low

Analysis Process: NEW PRICE ENQUIRY FROM PHILLIPINES.exe PID: 6028 Parent PID: 6384

General

Start time:	13:17:43
Start date:	13/01/2022
Path:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\NEW PRICE ENQUIRY FROM PHILLIPINES.exe
Imagebase:	0xb30000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000000.401599890.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000000.399852630.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000002.419651818.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000002.422650561.0000000003F39000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000000.400872945.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000000.402275607.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000009.00000002.422458870.0000000002F31000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: dhcpmon.exe PID: 3832 Parent PID: 3440

General

Start time:	13:17:46
Start date:	13/01/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe"
Imagebase:	0x280000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000002.438498582.00000000037F9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000000B.00000002.436456049.00000000027F1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: dhcpmon.exe PID: 5644 Parent PID: 4800

General

Start time:	13:17:46
Start date:	13/01/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Imagebase:	0x760000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000000.407997541.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000000.410261588.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.432251461.0000000003B29000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000000.407141178.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.432084742.0000000002B21000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.430827795.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000000.408833633.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: dhcpmon.exe PID: 6728 Parent PID: 3832

General

Start time:	13:17:51
Start date:	13/01/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Imagebase:	0x3c0000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: dhcpmon.exe PID: 6780 Parent PID: 3832

General

Start time:	13:17:53
Start date:	13/01/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Imagebase:	0x170000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: dhcpmon.exe PID: 6992 Parent PID: 3832

General

Start time:	13:17:56
Start date:	13/01/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Imagebase:	0xa40000
File size:	784384 bytes
MD5 hash:	CA0D3CA986E592EC436052F747F833C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000000.429662916.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000000.432836142.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000002.451199404.0000000003E49000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000000.431618289.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000000.430712249.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000002.449718665.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000012.00000002.451040533.0000000002E41000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report NEW PRICE ENQUIRY FROM PHILLIPINES.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

AV Detection:

E-Banking Fraud:

System Summary:

Stealing of Sensitive Information:

Remote Access Functionality:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets