Windows Analysis Report PO#0065026.doc.exe

Overview

General Information

Sample Name: PO#0065026.doc.exe
Analysis ID: 553030
MD5: 233064525984666fe973125f4e60c903
SHA1: 91bec44a6ff58c22cc58122b2daab04fd54dcf8e
SHA256: 30e1ba61a63a27b668eee09f960a83d944e878c33b46f85ea86bacdf1427f4dd
Tags: exeNanoCoreRAT
Infos:

Most interesting Screenshot:

Detection

Nanocore
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Sigma detected: Suspicious Double Extension
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Detected unpacking (overwrites its own PE header)
Sigma detected: NanoCore
Yara detected AntiVM3
Detected Nanocore Rat
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for dropped file
Yara detected Nanocore RAT
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Sigma detected: Suspicius Add Task From User AppData Temp
Machine Learning detection for sample
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Installs a raw input device (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Detected TCP or UDP traffic on non-standard ports
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000016.00000002.391042000.0000000002B51000.00000004.00000001.sdmp Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "1122355e-5fe3-470d-a458-8c4cf035", "Group": "Default", "Domain1": "185.140.53.132", "Domain2": "127.0.0.1", "Port": 1604, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}
Multi AV Scanner detection for submitted file
Source: PO#0065026.doc.exe ReversingLabs: Detection: 23%
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe ReversingLabs: Detection: 23%
Yara detected Nanocore RAT
Source: Yara match File source: 1.2.PO#0065026.doc.exe.5131b38.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4fd2388.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4cd1e50.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4cd1e50.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4f9f768.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO#0065026.doc.exe.50fef18.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3b9b7be.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO#0065026.doc.exe.5131b38.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c905f4.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4c9f230.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4fd2388.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3ba05f4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c905f4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c8b7be.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO#0065026.doc.exe.50fef18.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c94c1d.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3ba4c1d.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4c9f230.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3ba05f4.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4f9f768.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000000.366825626.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.333627100.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.391042000.0000000002B51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.337826803.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.335589407.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.300740890.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.389921703.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000000.367777233.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.302917559.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.352052455.0000000004E90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000000.369712840.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.366690953.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.300022383.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.312409953.0000000004FF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000000.365733325.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.336831952.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.301457212.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.363668804.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.375404860.0000000004B90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.366795171.0000000003C49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.391135988.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 7096, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 5348, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 6712, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 7160, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 1312, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 6592, type: MEMORYSTR
Machine Learning detection for sample
Source: PO#0065026.doc.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 19.0.PO#0065026.doc.exe.400000.10.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 22.0.dhcpmon.exe.400000.10.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 19.0.PO#0065026.doc.exe.400000.12.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 10.0.PO#0065026.doc.exe.400000.4.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 19.0.PO#0065026.doc.exe.400000.8.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 10.0.PO#0065026.doc.exe.400000.10.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 19.0.PO#0065026.doc.exe.400000.6.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 19.0.PO#0065026.doc.exe.400000.4.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 10.0.PO#0065026.doc.exe.400000.12.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 22.0.dhcpmon.exe.400000.12.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 10.0.PO#0065026.doc.exe.400000.6.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 22.0.dhcpmon.exe.400000.8.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 22.0.dhcpmon.exe.400000.4.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 10.0.PO#0065026.doc.exe.400000.8.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 22.0.dhcpmon.exe.400000.6.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 22.2.dhcpmon.exe.400000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen7
Source: 19.2.PO#0065026.doc.exe.400000.0.unpack Avira: Label: TR/Dropper.MSIL.Gen7

Compliance:

barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Unpacked PE file: 1.2.PO#0065026.doc.exe.ee0000.0.unpack
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Unpacked PE file: 13.2.PO#0065026.doc.exe.f10000.0.unpack
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Unpacked PE file: 17.2.dhcpmon.exe.d0000.0.unpack
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Unpacked PE file: 20.2.dhcpmon.exe.ba0000.0.unpack
Uses 32bit PE files
Source: PO#0065026.doc.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: PO#0065026.doc.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49744 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49747 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49748 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49749 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49750 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49752 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49769 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49788 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49794 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49796 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49811 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49820 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49822 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49823 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49824 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49825 -> 185.140.53.132:1604
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49826 -> 185.140.53.132:1604
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 185.140.53.132
Source: Malware configuration extractor URLs: 127.0.0.1
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DAVID_CRAIGGG DAVID_CRAIGGG
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.140.53.132 185.140.53.132
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49744 -> 185.140.53.132:1604
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: unknown TCP traffic detected without corresponding DNS query: 185.140.53.132
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.281908317.0000000008A92000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PO#0065026.doc.exe, 00000001.00000003.282759013.0000000008A6F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com
Source: PO#0065026.doc.exe, 00000001.00000003.281954598.0000000008A92000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.281931325.0000000008A92000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.281983436.0000000008A92000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comaU
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: PO#0065026.doc.exe, 00000001.00000003.282759013.0000000008A6F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comn-u
Source: PO#0065026.doc.exe, 00000001.00000003.282759013.0000000008A6F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.compef6K
Source: PO#0065026.doc.exe, 00000001.00000003.282759013.0000000008A6F000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comuesDK
Source: PO#0065026.doc.exe, 00000001.00000003.286220065.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286794704.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286168834.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286696568.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286025037.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286077095.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286757609.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285994377.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286497925.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285955232.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286144506.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286054615.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286241958.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285719117.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286193130.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286111728.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286341063.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286591042.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286369233.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286312331.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286286284.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286398367.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286435701.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286622956.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286467614.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: PO#0065026.doc.exe, 00000001.00000003.292204726.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: PO#0065026.doc.exe, 00000001.00000003.285719117.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: PO#0065026.doc.exe, 00000001.00000003.286497925.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286241958.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286341063.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286591042.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286369233.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286312331.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286286284.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286398367.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286435701.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286622956.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286467614.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmlL
Source: PO#0065026.doc.exe, 00000001.00000003.285719117.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/i-f1
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: PO#0065026.doc.exe, 00000001.00000003.287349533.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287421417.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287302845.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersU
Source: PO#0065026.doc.exe, 00000001.00000003.286901024.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designerslR
Source: PO#0065026.doc.exe, 00000001.00000003.285859144.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285794499.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285814497.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersp
Source: PO#0065026.doc.exe, 00000001.00000003.287302845.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287057215.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comF
Source: PO#0065026.doc.exe, 00000001.00000003.286220065.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286168834.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286025037.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286077095.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285994377.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286144506.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286054615.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286241958.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286193130.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286111728.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comFc
Source: PO#0065026.doc.exe, 00000001.00000003.285719117.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comTTF
Source: PO#0065026.doc.exe, 00000001.00000002.313547078.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292251947.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292352678.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292227161.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292325246.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.304155607.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comY
Source: PO#0065026.doc.exe, 00000001.00000003.292251947.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292352678.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292227161.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292325246.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292204726.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: PO#0065026.doc.exe, 00000001.00000003.286220065.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286168834.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286696568.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286025037.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286077095.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286497925.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286144506.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286054615.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286241958.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286193130.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286111728.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286341063.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286591042.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286369233.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286312331.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286286284.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286398367.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286435701.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286622956.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286467614.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comaO
Source: PO#0065026.doc.exe, 00000001.00000003.286794704.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287349533.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287917248.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287421417.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287520519.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287016720.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287558454.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287600866.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287120035.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286941238.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287483541.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287248860.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287840611.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287181413.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287642342.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287684632.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287768748.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287302845.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287057215.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comaV
Source: PO#0065026.doc.exe, 00000001.00000003.287016720.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287120035.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286941238.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287248860.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287181413.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287057215.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comalsF
Source: PO#0065026.doc.exe, 00000001.00000003.287349533.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287917248.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287421417.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287520519.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287558454.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287600866.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287483541.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287840611.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287642342.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287684632.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287768748.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287302845.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comalsd
Source: PO#0065026.doc.exe, 00000001.00000003.286794704.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287349533.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286829225.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287917248.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287421417.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287520519.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286901024.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287016720.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287558454.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287600866.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287120035.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286941238.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287483541.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286863067.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287248860.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287840611.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287181413.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287642342.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287684632.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287768748.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287302845.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287057215.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comcom
Source: PO#0065026.doc.exe, 00000001.00000003.286497925.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286341063.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286369233.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286312331.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286286284.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286398367.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286435701.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286467614.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comcomFc
Source: PO#0065026.doc.exe, 00000001.00000003.285994377.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285955232.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comda
Source: PO#0065026.doc.exe, 00000001.00000003.286220065.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286168834.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286025037.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286077095.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285994377.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286144506.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286054615.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286241958.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286193130.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286111728.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comdc
Source: PO#0065026.doc.exe, 00000001.00000003.286220065.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286168834.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286696568.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286025037.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286077095.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286497925.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286144506.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286054615.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286241958.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286193130.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286111728.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286341063.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286591042.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286369233.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286312331.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286286284.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286398367.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286435701.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286622956.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286467614.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.come.com
Source: PO#0065026.doc.exe, 00000001.00000003.287917248.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287421417.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287520519.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287558454.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287600866.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287483541.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287840611.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.288037067.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287642342.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287684632.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287979043.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287768748.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comionaY
Source: PO#0065026.doc.exe, 00000001.00000003.286497925.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286241958.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286341063.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286591042.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286369233.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286312331.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286286284.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286398367.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286435701.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286622956.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286467614.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comitu/D
Source: PO#0065026.doc.exe, 00000001.00000002.313547078.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292251947.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292352678.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292227161.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292325246.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.304155607.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292204726.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.commcom
Source: PO#0065026.doc.exe, 00000001.00000003.285794499.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285814497.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.como
Source: PO#0065026.doc.exe, 00000001.00000003.285743125.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285794499.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285814497.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.compe
Source: PO#0065026.doc.exe, 00000001.00000003.286901024.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287016720.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287120035.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286941238.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287248860.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287181413.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.287057215.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comttod
Source: PO#0065026.doc.exe, 00000001.00000002.313547078.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292251947.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292352678.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292227161.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.292325246.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.304155607.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comue
Source: PO#0065026.doc.exe, 00000001.00000003.286220065.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286168834.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286696568.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286025037.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286077095.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285994377.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286497925.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285955232.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286144506.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285877220.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286054615.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286241958.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285859144.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286193130.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286111728.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286341063.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285794499.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286591042.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286369233.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286312331.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286286284.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286398367.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285894427.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286435701.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286622956.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285814497.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.286467614.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285912034.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comzana
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.281550617.0000000008A70000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.281544705.0000000008A92000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.281564553.0000000008A93000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.281675789.0000000008A92000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.281722139.0000000008A92000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.281496893.0000000008A70000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: PO#0065026.doc.exe, 00000001.00000003.281675789.0000000008A92000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.281341568.0000000008A92000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.281722139.0000000008A92000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.281766532.0000000008A76000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PO#0065026.doc.exe, 00000001.00000003.281456683.0000000008A94000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.281463758.0000000008A94000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnt
Source: PO#0065026.doc.exe, 00000001.00000003.289451558.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.289584198.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.289708771.0000000008A76000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.289557495.0000000008A76000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/
Source: PO#0065026.doc.exe, 00000001.00000003.289557495.0000000008A76000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/CD
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PO#0065026.doc.exe, 00000001.00000003.289747236.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.289451558.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.289584198.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/V
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: PO#0065026.doc.exe, 00000001.00000003.284162420.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.283325550.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284860652.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PO#0065026.doc.exe, 00000001.00000003.284701634.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284506074.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284632097.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284414828.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284735895.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284663157.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284264064.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284348337.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284561577.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284162420.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/-hu
Source: PO#0065026.doc.exe, 00000001.00000003.285170517.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284952891.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284701634.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284921330.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284769961.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284991694.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284506074.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285068399.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284632097.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284027428.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284414828.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285040871.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284735895.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285017058.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284663157.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284264064.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284348337.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284892458.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285102887.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284561577.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285137258.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284821861.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284162420.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284860652.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/D
Source: PO#0065026.doc.exe, 00000001.00000003.283755949.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/O
Source: PO#0065026.doc.exe, 00000001.00000003.284701634.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284506074.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284632097.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284027428.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284414828.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284735895.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284663157.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284264064.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284348337.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284561577.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284162420.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/V
Source: PO#0065026.doc.exe, 00000001.00000003.284506074.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284632097.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284027428.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284414828.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.283967988.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284663157.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284264064.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.283755949.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284348337.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284561577.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284162420.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y
Source: PO#0065026.doc.exe, 00000001.00000003.284701634.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284506074.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284632097.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284027428.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284414828.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284735895.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284663157.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284264064.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284348337.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284561577.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284162420.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0-f
Source: PO#0065026.doc.exe, 00000001.00000003.284701634.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284769961.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284506074.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284632097.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284027428.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284414828.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284735895.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284663157.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284264064.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284348337.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284892458.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284561577.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284821861.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284162420.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284860652.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/O
Source: PO#0065026.doc.exe, 00000001.00000003.284027428.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.283967988.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284264064.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.283755949.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284348337.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284162420.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/c
Source: PO#0065026.doc.exe, 00000001.00000003.284027428.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284414828.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.283967988.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284264064.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284348337.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284162420.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/hi
Source: PO#0065026.doc.exe, 00000001.00000003.284701634.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284506074.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284632097.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284414828.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284735895.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284663157.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284264064.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284348337.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284561577.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284162420.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/ite
Source: PO#0065026.doc.exe, 00000001.00000003.284952891.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284701634.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284921330.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284769961.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284991694.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284506074.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285068399.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284632097.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284027428.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284414828.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285040871.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284735895.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285017058.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.283967988.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284663157.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284264064.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.283755949.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284348337.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284892458.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284561577.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284821861.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284162420.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284860652.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: PO#0065026.doc.exe, 00000001.00000003.284701634.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284506074.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284632097.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284414828.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284735895.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284663157.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284561577.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/c
Source: PO#0065026.doc.exe, 00000001.00000003.285170517.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284952891.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284701634.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284921330.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284769961.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284991694.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284506074.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285068399.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284632097.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284414828.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285040871.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284735895.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285017058.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284663157.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284892458.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285102887.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284561577.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.285137258.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284821861.0000000008A91000.00000004.00000001.sdmp, PO#0065026.doc.exe, 00000001.00000003.284860652.0000000008A91000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/uro
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: PO#0065026.doc.exe, 00000001.00000002.313646282.0000000009C72000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: PO#0065026.doc.exe, 00000001.00000003.281908317.0000000008A92000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cnaU

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a raw input device (often for capturing keystrokes)
Source: PO#0065026.doc.exe, 00000013.00000002.366690953.0000000002C41000.00000004.00000001.sdmp Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

barindex
Yara detected Nanocore RAT
Source: Yara match File source: 1.2.PO#0065026.doc.exe.5131b38.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4fd2388.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4cd1e50.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4cd1e50.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4f9f768.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO#0065026.doc.exe.50fef18.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3b9b7be.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO#0065026.doc.exe.5131b38.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c905f4.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4c9f230.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4fd2388.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3ba05f4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c905f4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c8b7be.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO#0065026.doc.exe.50fef18.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c94c1d.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3ba4c1d.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4c9f230.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3ba05f4.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4f9f768.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000000.366825626.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.333627100.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.391042000.0000000002B51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.337826803.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.335589407.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.300740890.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.389921703.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000000.367777233.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.302917559.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.352052455.0000000004E90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000000.369712840.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.366690953.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.300022383.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.312409953.0000000004FF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000000.365733325.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.336831952.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.301457212.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.363668804.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.375404860.0000000004B90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.366795171.0000000003C49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.391135988.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 7096, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 5348, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 6712, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 7160, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 1312, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 6592, type: MEMORYSTR

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 1.2.PO#0065026.doc.exe.5131b38.5.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.PO#0065026.doc.exe.5131b38.5.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 22.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 22.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 13.2.PO#0065026.doc.exe.4fd2388.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.PO#0065026.doc.exe.4fd2388.4.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.dhcpmon.exe.4cd1e50.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.dhcpmon.exe.4cd1e50.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.dhcpmon.exe.4cd1e50.5.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.dhcpmon.exe.4cd1e50.5.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 13.2.PO#0065026.doc.exe.4f9f768.5.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.PO#0065026.doc.exe.4f9f768.5.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.PO#0065026.doc.exe.50fef18.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.PO#0065026.doc.exe.50fef18.4.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 22.2.dhcpmon.exe.3b9b7be.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 22.2.dhcpmon.exe.3b9b7be.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.PO#0065026.doc.exe.5131b38.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.PO#0065026.doc.exe.5131b38.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.PO#0065026.doc.exe.3c905f4.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.dhcpmon.exe.4c9f230.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.dhcpmon.exe.4c9f230.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 22.2.dhcpmon.exe.2bb9658.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.PO#0065026.doc.exe.4fd2388.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.PO#0065026.doc.exe.4fd2388.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 22.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 22.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 22.2.dhcpmon.exe.3ba05f4.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.PO#0065026.doc.exe.2ca9588.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.PO#0065026.doc.exe.3c905f4.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.PO#0065026.doc.exe.3c8b7be.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.PO#0065026.doc.exe.3c8b7be.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.PO#0065026.doc.exe.50fef18.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.PO#0065026.doc.exe.50fef18.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 22.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 22.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.PO#0065026.doc.exe.3c94c1d.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 22.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 22.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 22.2.dhcpmon.exe.3ba4c1d.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.dhcpmon.exe.4c9f230.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.dhcpmon.exe.4c9f230.4.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 22.2.dhcpmon.exe.3ba05f4.3.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 22.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 22.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 22.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 22.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.PO#0065026.doc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.PO#0065026.doc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 13.2.PO#0065026.doc.exe.4f9f768.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.PO#0065026.doc.exe.4f9f768.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000016.00000000.366825626.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000016.00000000.366825626.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000000.333627100.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000000.333627100.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000016.00000002.391042000.0000000002B51000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000000.337826803.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000000.337826803.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000000.335589407.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000000.335589407.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000000.300740890.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000000.300740890.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000016.00000002.389921703.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000016.00000002.389921703.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000016.00000000.367777233.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000016.00000000.367777233.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000000.302917559.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000000.302917559.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000D.00000002.352052455.0000000004E90000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000D.00000002.352052455.0000000004E90000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000016.00000000.369712840.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000016.00000000.369712840.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000002.366690953.0000000002C41000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000000.300022383.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000000.300022383.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.312409953.0000000004FF0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.312409953.0000000004FF0000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000016.00000000.365733325.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000016.00000000.365733325.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000000.336831952.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000000.336831952.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000A.00000000.301457212.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000000.301457212.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000002.363668804.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000002.363668804.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000014.00000002.375404860.0000000004B90000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.375404860.0000000004B90000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000002.366795171.0000000003C49000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000016.00000002.391135988.0000000003B59000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: PO#0065026.doc.exe PID: 7096, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: PO#0065026.doc.exe PID: 7096, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: PO#0065026.doc.exe PID: 5348, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: PO#0065026.doc.exe PID: 5348, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: PO#0065026.doc.exe PID: 6712, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: PO#0065026.doc.exe PID: 6712, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: PO#0065026.doc.exe PID: 7160, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: PO#0065026.doc.exe PID: 7160, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 1312, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 1312, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 6592, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dhcpmon.exe PID: 6592, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: PO#0065026.doc.exe
Uses 32bit PE files
Source: PO#0065026.doc.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 1.2.PO#0065026.doc.exe.5131b38.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.PO#0065026.doc.exe.5131b38.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.PO#0065026.doc.exe.5131b38.5.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 22.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 22.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 22.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 13.2.PO#0065026.doc.exe.4fd2388.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.2.PO#0065026.doc.exe.4fd2388.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 13.2.PO#0065026.doc.exe.4fd2388.4.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 20.2.dhcpmon.exe.4cd1e50.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 20.2.dhcpmon.exe.4cd1e50.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.dhcpmon.exe.4cd1e50.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 20.2.dhcpmon.exe.4cd1e50.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 20.2.dhcpmon.exe.4cd1e50.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.dhcpmon.exe.4cd1e50.5.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 13.2.PO#0065026.doc.exe.4f9f768.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.2.PO#0065026.doc.exe.4f9f768.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 13.2.PO#0065026.doc.exe.4f9f768.5.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.PO#0065026.doc.exe.50fef18.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.PO#0065026.doc.exe.50fef18.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.PO#0065026.doc.exe.50fef18.4.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 22.2.dhcpmon.exe.3b9b7be.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 22.2.dhcpmon.exe.3b9b7be.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 22.2.dhcpmon.exe.3b9b7be.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.PO#0065026.doc.exe.5131b38.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.PO#0065026.doc.exe.5131b38.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.PO#0065026.doc.exe.5131b38.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.PO#0065026.doc.exe.3c905f4.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.PO#0065026.doc.exe.3c905f4.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.dhcpmon.exe.4c9f230.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 20.2.dhcpmon.exe.4c9f230.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 22.2.dhcpmon.exe.2bb9658.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 22.2.dhcpmon.exe.2bb9658.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 13.2.PO#0065026.doc.exe.4fd2388.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.2.PO#0065026.doc.exe.4fd2388.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 13.2.PO#0065026.doc.exe.4fd2388.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 22.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 22.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 22.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 22.2.dhcpmon.exe.3ba05f4.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 22.2.dhcpmon.exe.3ba05f4.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.2.PO#0065026.doc.exe.2ca9588.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.PO#0065026.doc.exe.2ca9588.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.PO#0065026.doc.exe.3c905f4.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.PO#0065026.doc.exe.3c905f4.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.2.PO#0065026.doc.exe.3c8b7be.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.PO#0065026.doc.exe.3c8b7be.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.2.PO#0065026.doc.exe.3c8b7be.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.PO#0065026.doc.exe.50fef18.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.PO#0065026.doc.exe.50fef18.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 22.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 22.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 22.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.PO#0065026.doc.exe.3c94c1d.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.PO#0065026.doc.exe.3c94c1d.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 22.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 22.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 22.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 10.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 22.2.dhcpmon.exe.3ba4c1d.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 22.2.dhcpmon.exe.3ba4c1d.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.dhcpmon.exe.4c9f230.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 20.2.dhcpmon.exe.4c9f230.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.dhcpmon.exe.4c9f230.4.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 22.2.dhcpmon.exe.3ba05f4.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 22.2.dhcpmon.exe.3ba05f4.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 22.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 22.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 22.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 22.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 22.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 22.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.PO#0065026.doc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.PO#0065026.doc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.2.PO#0065026.doc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 13.2.PO#0065026.doc.exe.4f9f768.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.2.PO#0065026.doc.exe.4f9f768.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000016.00000000.366825626.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000016.00000000.366825626.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000000.333627100.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000000.333627100.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000016.00000002.391042000.0000000002B51000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000000.337826803.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000000.337826803.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000000.335589407.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000000.335589407.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000A.00000000.300740890.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000A.00000000.300740890.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000016.00000002.389921703.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000016.00000002.389921703.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000016.00000000.367777233.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000016.00000000.367777233.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000A.00000000.302917559.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000A.00000000.302917559.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000D.00000002.352052455.0000000004E90000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000D.00000002.352052455.0000000004E90000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000016.00000000.369712840.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000016.00000000.369712840.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000002.366690953.0000000002C41000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000A.00000000.300022383.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000A.00000000.300022383.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000002.312409953.0000000004FF0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.312409953.0000000004FF0000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000016.00000000.365733325.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000016.00000000.365733325.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000000.336831952.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000000.336831952.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000A.00000000.301457212.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000A.00000000.301457212.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000002.363668804.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000002.363668804.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000014.00000002.375404860.0000000004B90000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000014.00000002.375404860.0000000004B90000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000002.366795171.0000000003C49000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000016.00000002.391135988.0000000003B59000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: PO#0065026.doc.exe PID: 7096, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: PO#0065026.doc.exe PID: 7096, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: PO#0065026.doc.exe PID: 5348, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: PO#0065026.doc.exe PID: 5348, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: PO#0065026.doc.exe PID: 6712, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: PO#0065026.doc.exe PID: 6712, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: PO#0065026.doc.exe PID: 7160, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: PO#0065026.doc.exe PID: 7160, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 1312, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 1312, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 6592, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dhcpmon.exe PID: 6592, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Detected potential crypto function
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_01900BA8 1_2_01900BA8
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_01901FC0 1_2_01901FC0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_019033C0 1_2_019033C0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_01901310 1_2_01901310
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_01901300 1_2_01901300
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_019032C8 1_2_019032C8
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_019017C5 1_2_019017C5
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_019027E0 1_2_019027E0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_0190170A 1_2_0190170A
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_0190173F 1_2_0190173F
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_019019A7 1_2_019019A7
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_019028C0 1_2_019028C0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_0190186E 1_2_0190186E
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_01900B9A 1_2_01900B9A
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_01901D8C 1_2_01901D8C
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_01901C92 1_2_01901C92
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_01901C4D 1_2_01901C4D
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_01902F98 1_2_01902F98
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_01900FF0 1_2_01900FF0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_01901E76 1_2_01901E76
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_0BA3D880 1_2_0BA3D880
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_0BA30FE2 1_2_0BA30FE2
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_0BA30FF0 1_2_0BA30FF0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_0BA37EA1 1_2_0BA37EA1
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_0BA37EB0 1_2_0BA37EB0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_0BA37C38 1_2_0BA37C38
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_0BA37C48 1_2_0BA37C48
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_0BA35447 1_2_0BA35447
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_0BA35458 1_2_0BA35458
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_0BE20040 1_2_0BE20040
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_0BE20CF8 1_2_0BE20CF8
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_057F1FC0 13_2_057F1FC0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_057F0BA8 13_2_057F0BA8
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_057F0460 13_2_057F0460
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_057F170A 13_2_057F170A
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_057F33D0 13_2_057F33D0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_057F33C0 13_2_057F33C0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_057F28C0 13_2_057F28C0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_057F28B1 13_2_057F28B1
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_0A0B0040 13_2_0A0B0040
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_0A0B0CF8 13_2_0A0B0CF8
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_0B590FF0 13_2_0B590FF0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_0B590FEA 13_2_0B590FEA
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_0B597EB0 13_2_0B597EB0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_0B597EA1 13_2_0B597EA1
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_0B597C48 13_2_0B597C48
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_0B597C38 13_2_0B597C38
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_0B595458 13_2_0B595458
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_0B595447 13_2_0B595447
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_02410BA8 17_2_02410BA8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_02411FC0 17_2_02411FC0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_024133C0 17_2_024133C0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_024133D0 17_2_024133D0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_0241170A 17_2_0241170A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_0241173F 17_2_0241173F
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_024117C5 17_2_024117C5
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_02410B82 17_2_02410B82
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_0241186E 17_2_0241186E
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_024128C0 17_2_024128C0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_024128B1 17_2_024128B1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_024119A7 17_2_024119A7
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_02411E76 17_2_02411E76
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_02411FB8 17_2_02411FB8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_02411C4D 17_2_02411C4D
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_02411C92 17_2_02411C92
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_02411D8C 17_2_02411D8C
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_07A7C350 17_2_07A7C350
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_07A7EA88 17_2_07A7EA88
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_07A7F1A0 17_2_07A7F1A0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 19_2_02C0E480 19_2_02C0E480
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 19_2_02C0E471 19_2_02C0E471
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 19_2_02C0BBD4 19_2_02C0BBD4
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_03030BA8 20_2_03030BA8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_03031FC0 20_2_03031FC0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_030332C8 20_2_030332C8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_030307E7 20_2_030307E7
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_030306BA 20_2_030306BA
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_030306F1 20_2_030306F1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_0303051D 20_2_0303051D
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_03030578 20_2_03030578
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_030305AF 20_2_030305AF
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_030304AC 20_2_030304AC
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_03030B01 20_2_03030B01
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_03030A57 20_2_03030A57
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_03030A6A 20_2_03030A6A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_03030A99 20_2_03030A99
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_03030904 20_2_03030904
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_03030970 20_2_03030970
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_0303084D 20_2_0303084D
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_030328B1 20_2_030328B1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_030328C0 20_2_030328C0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_030308C5 20_2_030308C5
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_03031F93 20_2_03031F93
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_09D50040 20_2_09D50040
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_09D50CF8 20_2_09D50CF8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 20_2_09D54FE0 20_2_09D54FE0
Sample file is different than original file name gathered from version info
Source: PO#0065026.doc.exe Binary or memory string: OriginalFilename vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 00000001.00000002.304891399.0000000001010000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameDelegateEnt.exe0 vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 00000001.00000002.313958862.000000000BA00000.00000004.00020000.sdmp Binary or memory string: OriginalFilenamePeriodicity.dllL vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 00000001.00000002.306051032.0000000003510000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamePeriodicity.dllL vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 00000001.00000002.314043118.000000000BC70000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 00000001.00000002.307445609.0000000004D08000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUI.dllF vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 0000000A.00000000.297414840.0000000000A80000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameDelegateEnt.exe0 vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 0000000A.00000003.309845721.0000000001301000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDelegateEnt.exe0 vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 0000000A.00000003.326644045.000000000135F000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameToolsClientPlugin.dll4 vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe Binary or memory string: OriginalFilename vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 0000000D.00000002.341793363.000000000178A000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 0000000D.00000002.355322133.0000000009EF0000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 0000000D.00000002.341133942.0000000001040000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameDelegateEnt.exe0 vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 0000000D.00000002.344764757.0000000004BA8000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUI.dllF vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 0000000D.00000002.342454786.00000000033B0000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamePeriodicity.dllL vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 00000013.00000000.334788096.00000000007F0000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameDelegateEnt.exe0 vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 00000013.00000002.366690953.0000000002C41000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 00000013.00000002.366690953.0000000002C41000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameClientPlugin.dll4 vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 00000013.00000002.366795171.0000000003C49000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameClientPlugin.dll4 vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 00000013.00000002.366795171.0000000003C49000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameLzma#.dll4 vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe, 00000013.00000002.366795171.0000000003C49000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs PO#0065026.doc.exe
Source: PO#0065026.doc.exe Binary or memory string: OriginalFilenameDelegateEnt.exe0 vs PO#0065026.doc.exe
PE file contains strange resources
Source: PO#0065026.doc.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dhcpmon.exe.10.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PO#0065026.doc.exe ReversingLabs: Detection: 23%
Source: C:\Users\user\Desktop\PO#0065026.doc.exe File read: C:\Users\user\Desktop\PO#0065026.doc.exe Jump to behavior
Source: PO#0065026.doc.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\PO#0065026.doc.exe "C:\Users\user\Desktop\PO#0065026.doc.exe"
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process created: C:\Users\user\Desktop\PO#0065026.doc.exe C:\Users\user\Desktop\PO#0065026.doc.exe
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp71C5.tmp
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\Desktop\PO#0065026.doc.exe C:\Users\user\Desktop\PO#0065026.doc.exe 0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp7E78.tmp
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process created: C:\Users\user\Desktop\PO#0065026.doc.exe C:\Users\user\Desktop\PO#0065026.doc.exe
Source: unknown Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe"
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process created: C:\Users\user\Desktop\PO#0065026.doc.exe C:\Users\user\Desktop\PO#0065026.doc.exe Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp71C5.tmp Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp7E78.tmp Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process created: C:\Users\user\Desktop\PO#0065026.doc.exe C:\Users\user\Desktop\PO#0065026.doc.exe Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO#0065026.doc.exe.log Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe File created: C:\Users\user\AppData\Local\Temp\tmp71C5.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@19/11@0/1
Source: PO#0065026.doc.exe, 00000001.00000002.306051032.0000000003510000.00000004.00000001.sdmp, PO#0065026.doc.exe, 0000000D.00000002.342454786.00000000033B0000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.340545804.0000000002610000.00000004.00000001.sdmp, dhcpmon.exe, 00000014.00000002.373248632.00000000030B0000.00000004.00000001.sdmp Binary or memory string: SELECT @MAX = MAX([{0}])+1 FROM {1};5
Source: PO#0065026.doc.exe, 00000001.00000002.306051032.0000000003510000.00000004.00000001.sdmp, PO#0065026.doc.exe, 0000000D.00000002.342454786.00000000033B0000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.340545804.0000000002610000.00000004.00000001.sdmp, dhcpmon.exe, 00000014.00000002.373248632.00000000030B0000.00000004.00000001.sdmp Binary or memory string: SELECT IDENTITY_VAL_LOCAL() FROM SYSIBM.SYSDUMMY1;
Source: 10.0.PO#0065026.doc.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 10.0.PO#0065026.doc.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 22.0.dhcpmon.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 22.0.dhcpmon.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.0.PO#0065026.doc.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 19.0.PO#0065026.doc.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.0.PO#0065026.doc.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 19.0.PO#0065026.doc.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 10.0.PO#0065026.doc.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 10.0.PO#0065026.doc.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.2.PO#0065026.doc.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 19.2.PO#0065026.doc.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 10.0.PO#0065026.doc.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 10.0.PO#0065026.doc.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.0.PO#0065026.doc.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 19.0.PO#0065026.doc.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 10.0.PO#0065026.doc.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 10.0.PO#0065026.doc.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.0.PO#0065026.doc.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 19.0.PO#0065026.doc.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 10.0.PO#0065026.doc.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 10.0.PO#0065026.doc.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.0.PO#0065026.doc.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 19.0.PO#0065026.doc.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6664:120:WilError_01
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\{1122355e-5fe3-470d-a458-8c4cf0355482}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Mutant created: \Sessions\1\BaseNamedObjects\rYslOPaYizoR
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6604:120:WilError_01
Source: C:\Users\user\Desktop\PO#0065026.doc.exe File created: C:\Program Files (x86)\DHCP Monitor Jump to behavior
Source: PO#0065026.doc.exe, 00000001.00000002.306051032.0000000003510000.00000004.00000001.sdmp, PO#0065026.doc.exe, 0000000D.00000002.342454786.00000000033B0000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.340545804.0000000002610000.00000004.00000001.sdmp, dhcpmon.exe, 00000014.00000002.373248632.00000000030B0000.00000004.00000001.sdmp Binary or memory string: .csproj
Source: PO#0065026.doc.exe, 00000001.00000002.306051032.0000000003510000.00000004.00000001.sdmp, PO#0065026.doc.exe, 0000000D.00000002.342454786.00000000033B0000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.340545804.0000000002610000.00000004.00000001.sdmp, dhcpmon.exe, 00000014.00000002.373248632.00000000030B0000.00000004.00000001.sdmp Binary or memory string: .2010.csproj
Source: 10.0.PO#0065026.doc.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 10.0.PO#0065026.doc.exe.400000.4.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'CreateDecryptor'
Source: 10.0.PO#0065026.doc.exe.400000.4.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 10.0.PO#0065026.doc.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 10.0.PO#0065026.doc.exe.400000.10.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'CreateDecryptor'
Source: 10.0.PO#0065026.doc.exe.400000.10.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 10.0.PO#0065026.doc.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 10.0.PO#0065026.doc.exe.400000.12.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'CreateDecryptor'
Source: 10.0.PO#0065026.doc.exe.400000.12.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\PO#0065026.doc.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: PO#0065026.doc.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: PO#0065026.doc.exe Static file information: File size 1605632 > 1048576
Source: PO#0065026.doc.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: PO#0065026.doc.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x12ce00
Source: PO#0065026.doc.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Unpacked PE file: 1.2.PO#0065026.doc.exe.ee0000.0.unpack
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Unpacked PE file: 13.2.PO#0065026.doc.exe.f10000.0.unpack
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Unpacked PE file: 17.2.dhcpmon.exe.d0000.0.unpack
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Unpacked PE file: 20.2.dhcpmon.exe.ba0000.0.unpack
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Unpacked PE file: 1.2.PO#0065026.doc.exe.ee0000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Unpacked PE file: 13.2.PO#0065026.doc.exe.f10000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Unpacked PE file: 17.2.dhcpmon.exe.d0000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Unpacked PE file: 20.2.dhcpmon.exe.ba0000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;
.NET source code contains potential unpacker
Source: 10.0.PO#0065026.doc.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.PO#0065026.doc.exe.400000.4.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.PO#0065026.doc.exe.400000.10.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.PO#0065026.doc.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.PO#0065026.doc.exe.400000.12.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.PO#0065026.doc.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.PO#0065026.doc.exe.400000.6.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.PO#0065026.doc.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.PO#0065026.doc.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.PO#0065026.doc.exe.400000.8.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.PO#0065026.doc.exe.400000.10.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.PO#0065026.doc.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.PO#0065026.doc.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.PO#0065026.doc.exe.400000.12.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.PO#0065026.doc.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.PO#0065026.doc.exe.400000.8.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.PO#0065026.doc.exe.400000.6.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.PO#0065026.doc.exe.400000.6.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.PO#0065026.doc.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.0.PO#0065026.doc.exe.400000.4.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.2.PO#0065026.doc.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 19.2.PO#0065026.doc.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 22.0.dhcpmon.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 22.0.dhcpmon.exe.400000.10.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_00EE34D2 push esi; ret 1_2_00EE34D3
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_00EE4A4C push ds; retf 1_2_00EE4A5C
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_00EE441D push ds; iretd 1_2_00EE4425
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_00EE51C2 push ds; iretd 1_2_00EE51CB
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_00EE3370 push B75D66D8h; iretd 1_2_00EE3375
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 1_2_0BE2532F push FFFFFF8Bh; iretd 1_2_0BE2533F
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_00F134D2 push esi; ret 13_2_00F134D3
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_00F14A4C push ds; retf 13_2_00F14A5C
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_00F1441D push ds; iretd 13_2_00F14425
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_00F151C2 push ds; iretd 13_2_00F151CB
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_00F13370 push B75D66D8h; iretd 13_2_00F13375
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 13_2_0A0B533D push FFFFFF8Bh; iretd 13_2_0A0B533F
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_000D441D push ds; iretd 17_2_000D4425
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_000D4A4C push ds; retf 17_2_000D4A5C
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_000D34D2 push esi; ret 17_2_000D34D3
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_000D3370 push B75D66D8h; iretd 17_2_000D3375
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_000D51C2 push ds; iretd 17_2_000D51CB
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_07A75F38 push eax; mov dword ptr [esp], ecx 17_2_07A75F3C
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_07A92166 push edi; ret 17_2_07A92169
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_07A90B96 push esi; ret 17_2_07A90B97
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 17_2_07A98911 pushad ; iretd 17_2_07A9891D
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 19_2_006C4A4C push ds; retf 19_2_006C4A5C
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 19_2_006C441D push ds; iretd 19_2_006C4425
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 19_2_006C20C8 pushad ; iretd 19_2_006C20C9
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 19_2_006C34D2 push esi; ret 19_2_006C34D3
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 19_2_006C3370 push B75D66D8h; iretd 19_2_006C3375
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 19_2_006C51C2 push ds; iretd 19_2_006C51CB
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Code function: 19_2_006C2B83 push ebx; iretd 19_2_006C2B85
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 21_2_0021441D push ds; iretd 21_2_00214425
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 21_2_00214A4C push ds; retf 21_2_00214A5C
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 21_2_002120C8 pushad ; iretd 21_2_002120C9
Source: initial sample Static PE information: section name: .text entropy: 7.06155313656
Source: initial sample Static PE information: section name: .text entropy: 7.06155313656
Source: 10.0.PO#0065026.doc.exe.400000.4.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 10.0.PO#0065026.doc.exe.400000.4.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 10.0.PO#0065026.doc.exe.400000.10.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 10.0.PO#0065026.doc.exe.400000.10.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 10.0.PO#0065026.doc.exe.400000.12.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 10.0.PO#0065026.doc.exe.400000.12.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 10.0.PO#0065026.doc.exe.400000.6.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 10.0.PO#0065026.doc.exe.400000.6.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 10.0.PO#0065026.doc.exe.400000.8.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 10.0.PO#0065026.doc.exe.400000.8.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 19.0.PO#0065026.doc.exe.400000.10.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 19.0.PO#0065026.doc.exe.400000.10.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 19.0.PO#0065026.doc.exe.400000.12.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 19.0.PO#0065026.doc.exe.400000.12.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 19.0.PO#0065026.doc.exe.400000.8.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 19.0.PO#0065026.doc.exe.400000.8.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 19.0.PO#0065026.doc.exe.400000.6.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 19.0.PO#0065026.doc.exe.400000.6.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 19.0.PO#0065026.doc.exe.400000.4.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 19.0.PO#0065026.doc.exe.400000.4.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 19.2.PO#0065026.doc.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 19.2.PO#0065026.doc.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 22.0.dhcpmon.exe.400000.10.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 22.0.dhcpmon.exe.400000.10.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\PO#0065026.doc.exe File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Jump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp71C5.tmp

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\PO#0065026.doc.exe File opened: C:\Users\user\Desktop\PO#0065026.doc.exe:Zone.Identifier read attributes | delete Jump to behavior
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: doc.exe Static PE information: PO#0065026.doc.exe
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 17.2.dhcpmon.exe.2689d4c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.3129d4c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO#0065026.doc.exe.3589c7c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.3429c7c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000014.00000002.373248632.00000000030B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.340545804.0000000002610000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.306051032.0000000003510000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.342454786.00000000033B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 7096, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 6712, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 7112, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 1312, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: PO#0065026.doc.exe, 00000001.00000002.306051032.0000000003510000.00000004.00000001.sdmp, PO#0065026.doc.exe, 0000000D.00000002.342454786.00000000033B0000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.340545804.0000000002610000.00000004.00000001.sdmp, dhcpmon.exe, 00000014.00000002.373248632.00000000030B0000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: PO#0065026.doc.exe, 00000001.00000002.306051032.0000000003510000.00000004.00000001.sdmp, PO#0065026.doc.exe, 0000000D.00000002.342454786.00000000033B0000.00000004.00000001.sdmp, dhcpmon.exe, 00000011.00000002.340545804.0000000002610000.00000004.00000001.sdmp, dhcpmon.exe, 00000014.00000002.373248632.00000000030B0000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\PO#0065026.doc.exe TID: 7100 Thread sleep time: -38998s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe TID: 7140 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe TID: 7016 Thread sleep time: -13835058055282155s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe TID: 6708 Thread sleep time: -35214s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe TID: 6652 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 7084 Thread sleep time: -42467s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1068 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe TID: 1864 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1304 Thread sleep time: -44497s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 6208 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 7128 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Window / User API: threadDelayed 4944 Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Window / User API: threadDelayed 4497 Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Window / User API: foregroundWindowGot 745 Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Window / User API: foregroundWindowGot 654 Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Thread delayed: delay time: 38998 Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Thread delayed: delay time: 35214 Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 42467 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 44497 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477
Source: dhcpmon.exe, 00000014.00000002.373248632.00000000030B0000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: dhcpmon.exe, 00000014.00000002.373248632.00000000030B0000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 00000014.00000002.373248632.00000000030B0000.00000004.00000001.sdmp Binary or memory string: vmware
Source: dhcpmon.exe, 00000014.00000002.373248632.00000000030B0000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Memory written: C:\Users\user\Desktop\PO#0065026.doc.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Memory written: C:\Users\user\Desktop\PO#0065026.doc.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process created: C:\Users\user\Desktop\PO#0065026.doc.exe C:\Users\user\Desktop\PO#0065026.doc.exe Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp71C5.tmp Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp7E78.tmp Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Process created: C:\Users\user\Desktop\PO#0065026.doc.exe C:\Users\user\Desktop\PO#0065026.doc.exe Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Jump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Users\user\Desktop\PO#0065026.doc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Users\user\Desktop\PO#0065026.doc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Users\user\Desktop\PO#0065026.doc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Users\user\Desktop\PO#0065026.doc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\PO#0065026.doc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\Desktop\PO#0065026.doc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

Stealing of Sensitive Information:

barindex
Yara detected Nanocore RAT
Source: Yara match File source: 1.2.PO#0065026.doc.exe.5131b38.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4fd2388.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4cd1e50.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4cd1e50.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4f9f768.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO#0065026.doc.exe.50fef18.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3b9b7be.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO#0065026.doc.exe.5131b38.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c905f4.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4c9f230.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4fd2388.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3ba05f4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c905f4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c8b7be.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO#0065026.doc.exe.50fef18.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c94c1d.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3ba4c1d.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4c9f230.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3ba05f4.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4f9f768.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000000.366825626.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.333627100.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.391042000.0000000002B51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.337826803.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.335589407.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.300740890.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.389921703.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000000.367777233.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.302917559.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.352052455.0000000004E90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000000.369712840.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.366690953.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.300022383.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.312409953.0000000004FF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000000.365733325.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.336831952.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.301457212.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.363668804.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.375404860.0000000004B90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.366795171.0000000003C49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.391135988.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 7096, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 5348, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 6712, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 7160, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 1312, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 6592, type: MEMORYSTR

Remote Access Functionality:

barindex
Detected Nanocore Rat
Source: PO#0065026.doc.exe, 00000001.00000002.312409953.0000000004FF0000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: PO#0065026.doc.exe, 0000000A.00000000.300740890.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: PO#0065026.doc.exe, 0000000A.00000003.326644045.000000000135F000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: PO#0065026.doc.exe, 0000000D.00000002.352052455.0000000004E90000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: PO#0065026.doc.exe, 00000013.00000000.333627100.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: PO#0065026.doc.exe, 00000013.00000002.366690953.0000000002C41000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: PO#0065026.doc.exe, 00000013.00000002.366690953.0000000002C41000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: PO#0065026.doc.exe, 00000013.00000002.366795171.0000000003C49000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: PO#0065026.doc.exe, 00000013.00000002.366795171.0000000003C49000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 00000014.00000002.375404860.0000000004B90000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000016.00000000.366825626.0000000000402000.00000040.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000016.00000002.391042000.0000000002B51000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000016.00000002.391042000.0000000002B51000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 00000016.00000002.391135988.0000000003B59000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000016.00000002.391135988.0000000003B59000.00000004.00000001.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Yara detected Nanocore RAT
Source: Yara match File source: 1.2.PO#0065026.doc.exe.5131b38.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4fd2388.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4cd1e50.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4cd1e50.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4f9f768.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.PO#0065026.doc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO#0065026.doc.exe.50fef18.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3b9b7be.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO#0065026.doc.exe.5131b38.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c905f4.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4c9f230.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4fd2388.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3ba05f4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c905f4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c8b7be.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO#0065026.doc.exe.50fef18.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.3c94c1d.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.0.PO#0065026.doc.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3ba4c1d.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.dhcpmon.exe.4c9f230.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.3ba05f4.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.dhcpmon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.0.dhcpmon.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.PO#0065026.doc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.PO#0065026.doc.exe.4f9f768.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000000.366825626.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.333627100.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.391042000.0000000002B51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.337826803.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.335589407.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.300740890.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.389921703.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000000.367777233.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.302917559.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.352052455.0000000004E90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000000.369712840.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.366690953.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.300022383.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.312409953.0000000004FF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000000.365733325.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.336831952.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.301457212.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.363668804.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.375404860.0000000004B90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.366795171.0000000003C49000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.391135988.0000000003B59000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 7096, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 5348, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 6712, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: PO#0065026.doc.exe PID: 7160, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 1312, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dhcpmon.exe PID: 6592, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 553030 Sample: PO#0065026.doc.exe Startdate: 14/01/2022 Architecture: WINDOWS Score: 100 51 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->51 53 Found malware configuration 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 17 other signatures 2->57 8 PO#0065026.doc.exe 3 2->8         started        12 PO#0065026.doc.exe 2 2->12         started        14 dhcpmon.exe 2 2->14         started        16 dhcpmon.exe 3 2->16         started        process3 file4 47 C:\Users\user\...\PO#0065026.doc.exe.log, ASCII 8->47 dropped 61 Detected unpacking (changes PE section rights) 8->61 63 Detected unpacking (overwrites its own PE header) 8->63 65 Uses schtasks.exe or at.exe to add and modify task schedules 8->65 18 PO#0065026.doc.exe 1 15 8->18         started        67 Injects a PE file into a foreign processes 12->67 23 PO#0065026.doc.exe 2 12->23         started        25 dhcpmon.exe 14->25         started        27 dhcpmon.exe 14->27         started        29 BackgroundTransferHost.exe 14->29         started        signatures5 process6 dnsIp7 49 185.140.53.132, 1604, 49744, 49747 DAVID_CRAIGGG Sweden 18->49 39 C:\Program Files (x86)\...\dhcpmon.exe, PE32 18->39 dropped 41 C:\Users\user\AppData\Roaming\...\run.dat, data 18->41 dropped 43 C:\Users\user\AppData\Local\...\tmp71C5.tmp, XML 18->43 dropped 45 C:\...\dhcpmon.exe:Zone.Identifier, ASCII 18->45 dropped 59 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->59 31 schtasks.exe 1 18->31         started        33 schtasks.exe 1 18->33         started        file8 signatures9 process10 process11 35 conhost.exe 31->35         started        37 conhost.exe 33->37         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.140.53.132
 unknown Sweden
209623 DAVID_CRAIGGG true

Contacted URLs

Name Malicious Antivirus Detection Reputation
127.0.0.1 true
  • Avira URL Cloud: safe
 unknown
185.140.53.132 true
  • Avira URL Cloud: safe
 unknown