Windows Analysis Report
lg5wG9Xf5M.exe

Overview

General Information

Sample Name:	lg5wG9Xf5M.exe
Analysis ID:	623791
MD5:	0d8cb66d31ac86cd924b8d279a08f638
SHA1:	67027cf108b3d6c2f70213bb6a2092203563a905
SHA256:	73f9ccea6a86d11af4bdc6b570e4bf7089e89eafe5f8e27af428fce982b1938b
Tags:	exeNanoCoreRAT
Infos:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Detected unpacking (overwrites its own PE header)

Sigma detected: NanoCore

Yara detected AntiVM3

Detected Nanocore Rat

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Yara detected Nanocore RAT

Connects to many ports of the same IP (likely port scanning)

Protects its processes via BreakOnTermination flag

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Adds a directory exclusion to Windows Defender

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: lg5wG9Xf5M.exe	Virustotal: Detection: 40%			Perma Link
Source: lg5wG9Xf5M.exe	ReversingLabs: Detection: 60%

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Roaming\WabPKzGkhbokAF.exe	ReversingLabs: Detection: 60%

Yara detected Nanocore RAT

Source: Yara match	File source: 21.2.dhcpmon.exe.4467700.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.67f0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.67f4629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.dhcpmon.exe.44d2540.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.lg5wG9Xf5M.exe.4d9dd20.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.lg5wG9Xf5M.exe.4dd2540.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.dhcpmon.exe.449dd20.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.415b041.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.lg5wG9Xf5M.exe.4d9dd20.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.4c7dd20.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.lg5wG9Xf5M.exe.44ddd20.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.lg5wG9Xf5M.exe.4dd2540.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.lg5wG9Xf5M.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.4cb2540.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.lg5wG9Xf5M.exe.44ddd20.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.lg5wG9Xf5M.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.lg5wG9Xf5M.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.lg5wG9Xf5M.exe.3dab041.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.415560b.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.67f0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.lg5wG9Xf5M.exe.4512540.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.lg5wG9Xf5M.exe.4d67700.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.lg5wG9Xf5M.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.lg5wG9Xf5M.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.4c47700.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.415b041.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.lg5wG9Xf5M.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.lg5wG9Xf5M.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.lg5wG9Xf5M.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.lg5wG9Xf5M.exe.3da560b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.lg5wG9Xf5M.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.lg5wG9Xf5M.exe.44a7700.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.41507ce.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.lg5wG9Xf5M.exe.3da07ce.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.lg5wG9Xf5M.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.dhcpmon.exe.44d2540.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.lg5wG9Xf5M.exe.4512540.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.lg5wG9Xf5M.exe.3dab041.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.4cb2540.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.lg5wG9Xf5M.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.dhcpmon.exe.449dd20.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.4c7dd20.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000000.511485390.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.406454369.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.628285341.0000000004109000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.560908860.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.561189351.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.555073068.0000000003D59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.593914079.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.561144049.0000000004049000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.517691436.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.404180859.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.522962332.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.405610398.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.518607941.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.594069088.0000000003A59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.423846655.0000000004D67000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.521970769.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.521443319.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.630319253.00000000067F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.626914507.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.552201603.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.562287291.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.621069612.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.558227909.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.572113049.0000000004467000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.547454334.0000000004C47000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.548768280.00000000044A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.513879956.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.555956456.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.558867896.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.589257691.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.404837836.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.515341488.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.554816939.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lg5wG9Xf5M.exe PID: 7004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lg5wG9Xf5M.exe PID: 4944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lg5wG9Xf5M.exe PID: 5420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 7064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lg5wG9Xf5M.exe PID: 6068, type: MEMORYSTR

Machine Learning detection for sample

Source: lg5wG9Xf5M.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\WabPKzGkhbokAF.exe	Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 27.0.lg5wG9Xf5M.exe.400000.10.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 7.0.lg5wG9Xf5M.exe.400000.12.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 7.2.lg5wG9Xf5M.exe.67f0000.9.unpack	Avira: Label: TR/NanoCore.fadte
Source: 18.2.dhcpmon.exe.cc0000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 27.0.lg5wG9Xf5M.exe.400000.6.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 21.2.dhcpmon.exe.570000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 7.0.lg5wG9Xf5M.exe.400000.8.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 7.0.lg5wG9Xf5M.exe.400000.10.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 1.2.lg5wG9Xf5M.exe.d20000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 7.0.lg5wG9Xf5M.exe.400000.6.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 27.0.lg5wG9Xf5M.exe.400000.12.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 27.0.lg5wG9Xf5M.exe.400000.8.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 7.2.lg5wG9Xf5M.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 27.0.lg5wG9Xf5M.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 14.2.lg5wG9Xf5M.exe.460000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 27.2.lg5wG9Xf5M.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 7.0.lg5wG9Xf5M.exe.400000.4.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Unpacked PE file: 1.2.lg5wG9Xf5M.exe.d20000.0.unpack
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Unpacked PE file: 14.2.lg5wG9Xf5M.exe.460000.0.unpack
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Unpacked PE file: 18.2.dhcpmon.exe.cc0000.0.unpack
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Unpacked PE file: 21.2.dhcpmon.exe.570000.0.unpack

Uses 32bit PE files

Source: lg5wG9Xf5M.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: lg5wG9Xf5M.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\NanoProtectPlugin\NanoProtectClient\obj\Debug\NanoProtectClient.pdb source: lg5wG9Xf5M.exe, 00000007.00000002.628285341.0000000004109000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000007.00000002.626914507.0000000003101000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 0000001B.00000002.555073068.0000000003D59000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 0000001B.00000002.554816939.0000000002D51000.00000004.00000800.00020000.00000000.sdmp

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 102.89.42.162 ports 54761,1,4,5,6,7
Source: global traffic	TCP traffic: 185.19.85.160 ports 54761,1,4,5,6,7

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.7:49761 -> 102.89.42.162:54761
Source: global traffic	TCP traffic: 192.168.2.7:49787 -> 185.19.85.160:54761

Source: unknown	TCP traffic detected without corresponding DNS query: 185.19.85.160
Source: unknown	TCP traffic detected without corresponding DNS query: 185.19.85.160
Source: unknown	TCP traffic detected without corresponding DNS query: 185.19.85.160
Source: unknown	TCP traffic detected without corresponding DNS query: 185.19.85.160
Source: unknown	TCP traffic detected without corresponding DNS query: 185.19.85.160
Source: unknown	TCP traffic detected without corresponding DNS query: 185.19.85.160
Source: unknown	TCP traffic detected without corresponding DNS query: 185.19.85.160
Source: unknown	TCP traffic detected without corresponding DNS query: 185.19.85.160
Source: unknown	TCP traffic detected without corresponding DNS query: 185.19.85.160

Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: lg5wG9Xf5M.exe, 00000001.00000002.420348945.00000000031C1000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 0000000E.00000002.533947894.0000000002901000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000012.00000002.533946603.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000015.00000002.567673177.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.367405093.0000000008495000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.366499634.0000000008495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: lg5wG9Xf5M.exe, 00000001.00000003.365256352.00000000084CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: lg5wG9Xf5M.exe, 00000001.00000003.364413917.00000000084CB000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.364539761.00000000084CB000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.364625051.00000000084CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: lg5wG9Xf5M.exe, 00000001.00000003.366499634.0000000008495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.365906389.00000000084C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: lg5wG9Xf5M.exe, 00000001.00000003.365930939.00000000084C3000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.372560420.00000000084CB000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.365987086.00000000084C3000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.365906389.00000000084C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersUu
Source: lg5wG9Xf5M.exe, 00000001.00000003.364539761.00000000084CB000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.364625051.00000000084CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersp
Source: lg5wG9Xf5M.exe, 00000001.00000003.367405093.0000000008495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comD
Source: lg5wG9Xf5M.exe, 00000001.00000003.364932977.0000000008495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: lg5wG9Xf5M.exe, 00000001.00000003.367405093.0000000008495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comI.TTF
Source: lg5wG9Xf5M.exe, 00000001.00000003.364932977.0000000008495000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000002.425946347.0000000008490000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.416567907.0000000008490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: lg5wG9Xf5M.exe, 00000001.00000003.367405093.0000000008495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalsd
Source: lg5wG9Xf5M.exe, 00000001.00000003.364932977.0000000008495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comceTF
Source: lg5wG9Xf5M.exe, 00000001.00000002.425946347.0000000008490000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.416567907.0000000008490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comcevO
Source: lg5wG9Xf5M.exe, 00000001.00000003.367405093.0000000008495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comcomd(
Source: lg5wG9Xf5M.exe, 00000001.00000003.366499634.0000000008495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: lg5wG9Xf5M.exe, 00000001.00000002.425946347.0000000008490000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.416567907.0000000008490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.come.com
Source: lg5wG9Xf5M.exe, 00000001.00000003.367405093.0000000008495000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.366499634.0000000008495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comitud
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: lg5wG9Xf5M.exe, 00000001.00000003.358483589.00000000084CD000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.358343732.00000000084CE000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.358243954.00000000084CD000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.358530692.00000000084CD000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.358677525.00000000084CD000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.358260163.0000000008492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: lg5wG9Xf5M.exe, 00000001.00000003.358530692.00000000084CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnW
Source: lg5wG9Xf5M.exe, 00000001.00000003.368550226.00000000084C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: lg5wG9Xf5M.exe, 00000001.00000003.368781926.00000000084C3000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.369107364.00000000084C3000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.368605144.00000000084C3000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.368855413.00000000084C3000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.369010886.00000000084C3000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.368550226.00000000084C3000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.368695537.00000000084C3000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.368663528.00000000084C3000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.369061356.00000000084C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.355396876.0000000008493000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.355201678.0000000008492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: lg5wG9Xf5M.exe, 00000001.00000003.355396876.0000000008493000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com4
Source: lg5wG9Xf5M.exe, 00000001.00000003.355396876.0000000008493000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com?
Source: lg5wG9Xf5M.exe, 00000001.00000003.355396876.0000000008493000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comh
Source: lg5wG9Xf5M.exe, 00000001.00000003.355201678.0000000008492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comurs
Source: lg5wG9Xf5M.exe, 00000001.00000003.355396876.0000000008493000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com~
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 00000001.00000003.362267187.00000000084CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: lg5wG9Xf5M.exe, 00000001.00000002.426295468.00000000096A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: lg5wG9Xf5M.exe, 00000001.00000003.359631857.000000000849E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnue

Source: unknown

DNS traffic detected: queries for: fastspeed.ddnsfree.com

Creates a DirectInput object (often for capturing keystrokes)

Source: lg5wG9Xf5M.exe, 00000001.00000002.419138995.00000000013D9000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Installs a raw input device (often for capturing keystrokes)

Source: lg5wG9Xf5M.exe, 00000007.00000002.628285341.0000000004109000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud

Yara detected Nanocore RAT

Source: Yara match	File source: 21.2.dhcpmon.exe.4467700.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.67f0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.67f4629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.dhcpmon.exe.44d2540.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.lg5wG9Xf5M.exe.4d9dd20.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.lg5wG9Xf5M.exe.4dd2540.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.dhcpmon.exe.449dd20.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.415b041.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.lg5wG9Xf5M.exe.4d9dd20.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.4c7dd20.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.lg5wG9Xf5M.exe.44ddd20.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.lg5wG9Xf5M.exe.4dd2540.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.lg5wG9Xf5M.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.4cb2540.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.lg5wG9Xf5M.exe.44ddd20.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.lg5wG9Xf5M.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.lg5wG9Xf5M.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.lg5wG9Xf5M.exe.3dab041.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.415560b.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.67f0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.lg5wG9Xf5M.exe.4512540.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.lg5wG9Xf5M.exe.4d67700.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.lg5wG9Xf5M.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.lg5wG9Xf5M.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.4c47700.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.415b041.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.lg5wG9Xf5M.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.lg5wG9Xf5M.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.lg5wG9Xf5M.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.lg5wG9Xf5M.exe.3da560b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.lg5wG9Xf5M.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.lg5wG9Xf5M.exe.44a7700.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lg5wG9Xf5M.exe.41507ce.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.lg5wG9Xf5M.exe.3da07ce.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.lg5wG9Xf5M.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.dhcpmon.exe.44d2540.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.lg5wG9Xf5M.exe.4512540.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.lg5wG9Xf5M.exe.3dab041.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.4cb2540.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.lg5wG9Xf5M.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.dhcpmon.exe.449dd20.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.dhcpmon.exe.4c7dd20.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000000.511485390.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.406454369.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.628285341.0000000004109000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.560908860.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.561189351.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.555073068.0000000003D59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.593914079.0000000002A51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.561144049.0000000004049000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.517691436.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.404180859.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.522962332.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.405610398.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.518607941.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.594069088.0000000003A59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.423846655.0000000004D67000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.521970769.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.521443319.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.630319253.00000000067F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.626914507.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.552201603.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.562287291.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.621069612.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.558227909.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.572113049.0000000004467000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.547454334.0000000004C47000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.548768280.00000000044A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.513879956.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.555956456.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.558867896.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.589257691.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.404837836.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.515341488.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.554816939.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lg5wG9Xf5M.exe PID: 7004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lg5wG9Xf5M.exe PID: 4944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lg5wG9Xf5M.exe PID: 5420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 7064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lg5wG9Xf5M.exe PID: 6068, type: MEMORYSTR

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe

Process information set: 01 00 00 00

Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B18A8	1_2_018B18A8
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B1020	1_2_018B1020
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B2258	1_2_018B2258
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B0480	1_2_018B0480
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018BB6D0	1_2_018BB6D0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B51A0	1_2_018B51A0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B51B0	1_2_018B51B0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B5880	1_2_018B5880
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B1899	1_2_018B1899
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B5870	1_2_018B5870
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B53E0	1_2_018B53E0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B53F0	1_2_018B53F0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B224A	1_2_018B224A
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B35A0	1_2_018B35A0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B0478	1_2_018B0478
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B3FD0	1_2_018B3FD0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B3FE0	1_2_018B3FE0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B0FF1	1_2_018B0FF1
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B5688	1_2_018B5688
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B4E30	1_2_018B4E30
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B4E40	1_2_018B4E40
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B5679	1_2_018B5679
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_056F0040	1_2_056F0040
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_056F0006	1_2_056F0006
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_056F7300	1_2_056F7300
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_0A04003F	1_2_0A04003F
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_0A040040	1_2_0A040040
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 7_2_0554E471	7_2_0554E471
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 7_2_0554E480	7_2_0554E480
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 7_2_0554BBD4	7_2_0554BBD4
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 7_2_06930040	7_2_06930040
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F2258	14_2_026F2258
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F1020	14_2_026F1020
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F18A8	14_2_026F18A8
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026FB6D0	14_2_026FB6D0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F0480	14_2_026F0480
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F224B	14_2_026F224B
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F53E0	14_2_026F53E0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F53F0	14_2_026F53F0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F5870	14_2_026F5870
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F5880	14_2_026F5880
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F189B	14_2_026F189B
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F51A0	14_2_026F51A0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F51B0	14_2_026F51B0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F5679	14_2_026F5679
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F4E40	14_2_026F4E40
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F4E30	14_2_026F4E30
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F5688	14_2_026F5688
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F0F70	14_2_026F0F70
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F3FE0	14_2_026F3FE0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F3FD0	14_2_026F3FD0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F3F98	14_2_026F3F98
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F0471	14_2_026F0471
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F35B2	14_2_026F35B2
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_04E39B28	14_2_04E39B28
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_04E30040	14_2_04E30040
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_04E30007	14_2_04E30007
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_08D43940	14_2_08D43940
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_08D41898	14_2_08D41898
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_08D418A8	14_2_08D418A8
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_08D43930	14_2_08D43930
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_08D44B3C	14_2_08D44B3C
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_08D461B0	14_2_08D461B0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_08D46495	14_2_08D46495
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E9224A	18_2_02E9224A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E91020	18_2_02E91020
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E9B6D0	18_2_02E9B6D0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E90471	18_2_02E90471
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E9189A	18_2_02E9189A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E953E0	18_2_02E953E0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E953F0	18_2_02E953F0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E91010	18_2_02E91010
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E951A0	18_2_02E951A0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E951B0	18_2_02E951B0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E95688	18_2_02E95688
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E95679	18_2_02E95679
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E95870	18_2_02E95870
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E94E30	18_2_02E94E30
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E93FE0	18_2_02E93FE0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E90FFF	18_2_02E90FFF
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E93FD0	18_2_02E93FD0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_095A3940	18_2_095A3940
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_095A3930	18_2_095A3930
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_095A1898	18_2_095A1898
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_095A18A8	18_2_095A18A8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_095A4B3C	18_2_095A4B3C
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_095A6495	18_2_095A6495
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_099F003E	18_2_099F003E
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_099F0040	18_2_099F0040
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E218A8	21_2_00E218A8
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E21020	21_2_00E21020
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E22258	21_2_00E22258
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E20480	21_2_00E20480
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E2B6D0	21_2_00E2B6D0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E25880	21_2_00E25880
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E21899	21_2_00E21899
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E251A0	21_2_00E251A0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E251B0	21_2_00E251B0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E2224A	21_2_00E2224A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E253E0	21_2_00E253E0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E253F0	21_2_00E253F0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E20471	21_2_00E20471
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E25688	21_2_00E25688
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E24E40	21_2_00E24E40
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E23FE0	21_2_00E23FE0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E20FF1	21_2_00E20FF1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E23FD0	21_2_00E23FD0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E23F98	21_2_00E23F98
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_093C0040	21_2_093C0040
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_093C7300	21_2_093C7300
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_093E003F	21_2_093E003F
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_093E0040	21_2_093E0040

Source: lg5wG9Xf5M.exe	Binary or memory string: OriginalFilename vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000001.00000002.418463535.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHMAC.exe2 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000001.00000003.382753177.0000000009B7D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHMAC.exe2 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000001.00000002.419733236.0000000002EE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDotNetZipAdditionalPlatforms.dllZ vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000001.00000002.423305102.00000000049C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDotNetZipAdditionalPlatforms.dllZ vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000001.00000000.348458525.0000000000D22000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHMAC.exe2 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000001.00000002.419138995.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe	Binary or memory string: OriginalFilename vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000007.00000002.628285341.0000000004109000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000007.00000002.628285341.0000000004109000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNanoProtectClient.dllT vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000007.00000002.628285341.0000000004109000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000007.00000002.628285341.0000000004109000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000007.00000000.404900976.0000000000CF2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHMAC.exe2 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000007.00000002.630402836.0000000006820000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000007.00000002.630319253.00000000067F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000007.00000002.630319253.00000000067F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000007.00000002.626914507.0000000003101000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000007.00000002.626914507.0000000003101000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNanoProtectClient.dllT vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000007.00000002.630182953.0000000006760000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 00000007.00000002.622939338.000000000141A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe	Binary or memory string: OriginalFilename vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 0000000E.00000002.523899292.0000000000502000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHMAC.exe2 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 0000000E.00000002.529124810.0000000000D60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDotNetZipAdditionalPlatforms.dllZ vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 0000000E.00000002.552651082.0000000008DD0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameFort.dll" vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 0000000E.00000002.526240638.0000000000C29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 0000000E.00000002.546313587.0000000004105000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDotNetZipAdditionalPlatforms.dllZ vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 0000000E.00000000.435597543.0000000000462000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHMAC.exe2 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 0000001B.00000002.552393644.0000000000992000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHMAC.exe2 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 0000001B.00000002.555073068.0000000003D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 0000001B.00000002.555073068.0000000003D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNanoProtectClient.dllT vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 0000001B.00000002.555073068.0000000003D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 0000001B.00000002.555073068.0000000003D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 0000001B.00000002.553386454.00000000010D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 0000001B.00000002.554816939.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 0000001B.00000002.554816939.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs lg5wG9Xf5M.exe
Source: lg5wG9Xf5M.exe, 0000001B.00000002.554816939.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNanoProtectClient.dllT vs lg5wG9Xf5M.exe

Source: lg5wG9Xf5M.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WabPKzGkhbokAF.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dhcpmon.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: unknown	Process created: C:\Users\user\Desktop\lg5wG9Xf5M.exe "C:\Users\user\Desktop\lg5wG9Xf5M.exe"
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\WabPKzGkhbokAF.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WabPKzGkhbokAF" /XML "C:\Users\user\AppData\Local\Temp\tmpE5A3.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Users\user\Desktop\lg5wG9Xf5M.exe C:\Users\user\Desktop\lg5wG9Xf5M.exe
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpB017.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\lg5wG9Xf5M.exe C:\Users\user\Desktop\lg5wG9Xf5M.exe 0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmpBF4A.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe"
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\WabPKzGkhbokAF.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WabPKzGkhbokAF" /XML "C:\Users\user\AppData\Local\Temp\tmp7FCF.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\WabPKzGkhbokAF.exe
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Users\user\Desktop\lg5wG9Xf5M.exe C:\Users\user\Desktop\lg5wG9Xf5M.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WabPKzGkhbokAF" /XML "C:\Users\user\AppData\Local\Temp\tmpA171.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\WabPKzGkhbokAF.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WabPKzGkhbokAF" /XML "C:\Users\user\AppData\Local\Temp\tmpCBBD.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\WabPKzGkhbokAF.exe	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WabPKzGkhbokAF" /XML "C:\Users\user\AppData\Local\Temp\tmpE5A3.tmp	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Users\user\Desktop\lg5wG9Xf5M.exe C:\Users\user\Desktop\lg5wG9Xf5M.exe	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpB017.tmp	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmpBF4A.tmp	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\WabPKzGkhbokAF.exe	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WabPKzGkhbokAF" /XML "C:\Users\user\AppData\Local\Temp\tmp7FCF.tmp	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process created: C:\Users\user\Desktop\lg5wG9Xf5M.exe C:\Users\user\Desktop\lg5wG9Xf5M.exe	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\WabPKzGkhbokAF.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WabPKzGkhbokAF" /XML "C:\Users\user\AppData\Local\Temp\tmpA171.tmp
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\WabPKzGkhbokAF.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WabPKzGkhbokAF" /XML "C:\Users\user\AppData\Local\Temp\tmpCBBD.tmp
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Source: 7.0.lg5wG9Xf5M.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 7.0.lg5wG9Xf5M.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 7.0.lg5wG9Xf5M.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 7.0.lg5wG9Xf5M.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 7.0.lg5wG9Xf5M.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 7.0.lg5wG9Xf5M.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 7.2.lg5wG9Xf5M.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 7.2.lg5wG9Xf5M.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 7.0.lg5wG9Xf5M.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 7.0.lg5wG9Xf5M.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6892:120:WilError_01
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{b3a6f9ad-fdc4-4025-8d68-cc0f37771046}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4992:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6836:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4624:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:640:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1404:120:WilError_01

Source: 7.0.lg5wG9Xf5M.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.0.lg5wG9Xf5M.exe.400000.12.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 7.0.lg5wG9Xf5M.exe.400000.12.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 7.0.lg5wG9Xf5M.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.0.lg5wG9Xf5M.exe.400000.8.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 7.0.lg5wG9Xf5M.exe.400000.8.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 7.0.lg5wG9Xf5M.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.0.lg5wG9Xf5M.exe.400000.10.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 7.0.lg5wG9Xf5M.exe.400000.10.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: 7.0.lg5wG9Xf5M.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.lg5wG9Xf5M.exe.400000.12.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.lg5wG9Xf5M.exe.400000.8.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.lg5wG9Xf5M.exe.400000.8.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.lg5wG9Xf5M.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.lg5wG9Xf5M.exe.400000.10.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.2.lg5wG9Xf5M.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.2.lg5wG9Xf5M.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.lg5wG9Xf5M.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.lg5wG9Xf5M.exe.400000.4.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: 7.2.lg5wG9Xf5M.exe.41507ce.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.lg5wG9Xf5M.exe.41507ce.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 7.2.lg5wG9Xf5M.exe.41507ce.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 27.2.lg5wG9Xf5M.exe.3da07ce.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 27.2.lg5wG9Xf5M.exe.3da07ce.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 27.2.lg5wG9Xf5M.exe.3da07ce.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 21.2.dhcpmon.exe.4467700.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.dhcpmon.exe.4467700.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 21.2.dhcpmon.exe.4467700.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 7.2.lg5wG9Xf5M.exe.67f0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.lg5wG9Xf5M.exe.67f0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 7.2.lg5wG9Xf5M.exe.67f0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 7.2.lg5wG9Xf5M.exe.67f4629.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.lg5wG9Xf5M.exe.67f4629.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 7.2.lg5wG9Xf5M.exe.67f4629.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 21.2.dhcpmon.exe.44d2540.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.dhcpmon.exe.44d2540.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.dhcpmon.exe.44d2540.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 21.2.dhcpmon.exe.44d2540.9.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.lg5wG9Xf5M.exe.4d9dd20.12.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.lg5wG9Xf5M.exe.4d9dd20.12.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 1.2.lg5wG9Xf5M.exe.4d9dd20.12.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.lg5wG9Xf5M.exe.4dd2540.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.lg5wG9Xf5M.exe.4dd2540.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.lg5wG9Xf5M.exe.4dd2540.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 1.2.lg5wG9Xf5M.exe.4dd2540.10.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 21.2.dhcpmon.exe.449dd20.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 21.2.dhcpmon.exe.449dd20.10.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.dhcpmon.exe.449dd20.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 21.2.dhcpmon.exe.449dd20.10.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 27.2.lg5wG9Xf5M.exe.2db95a8.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 27.2.lg5wG9Xf5M.exe.2db95a8.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 27.2.lg5wG9Xf5M.exe.2db95a8.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 7.2.lg5wG9Xf5M.exe.415b041.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.lg5wG9Xf5M.exe.415b041.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 7.2.lg5wG9Xf5M.exe.415b041.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 1.2.lg5wG9Xf5M.exe.4d9dd20.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.lg5wG9Xf5M.exe.4d9dd20.12.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 1.2.lg5wG9Xf5M.exe.4d9dd20.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 1.2.lg5wG9Xf5M.exe.4d9dd20.12.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_00D24FEF push eax; retf	1_2_00D25042
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_00D25795 push ds; retf	1_2_00D257B5
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_00D23BB1 push eax; ret	1_2_00D23BB6
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_00D233B1 pushad ; iretd	1_2_00D233C9
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 1_2_018B64F7 pushad ; retf	1_2_018B64FA
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 7_2_00CF4FEF push eax; retf	7_2_00CF5042
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 7_2_00CF5795 push ds; retf	7_2_00CF57B5
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 7_2_00CF3BB1 push eax; ret	7_2_00CF3BB6
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 7_2_00CF33B1 pushad ; iretd	7_2_00CF33C9
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 7_2_06934CEC push es; ret	7_2_06934CF0
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_00464FEF push eax; retf	14_2_00465042
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_00465795 push ds; retf	14_2_004657B5
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_00463BB1 push eax; ret	14_2_00463BB6
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_004633B1 pushad ; iretd	14_2_004633C9
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_026F64F7 pushad ; retf	14_2_026F64FA
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_04E367E8 pushfd ; retf	14_2_04E367E9
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Code function: 14_2_04E367A2 push esp; retf	14_2_04E367A9
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_00CC4FEF push eax; retf	18_2_00CC5042
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_00CC5795 push ds; retf	18_2_00CC57B5
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_00CC3BB1 push eax; ret	18_2_00CC3BB6
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_00CC33B1 pushad ; iretd	18_2_00CC33C9
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 18_2_02E964F7 pushad ; retf	18_2_02E964FA
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00574FEF push eax; retf	21_2_00575042
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00575795 push ds; retf	21_2_005757B5
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00573BB1 push eax; ret	21_2_00573BB6
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_005733B1 pushad ; iretd	21_2_005733C9
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_00E264F7 pushad ; retf	21_2_00E264FA
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 21_2_093C67E8 pushfd ; retf	21_2_093C67E9

Source: initial sample	Static PE information: section name: .text entropy: 7.74398552475
Source: initial sample	Static PE information: section name: .text entropy: 7.74398552475
Source: initial sample	Static PE information: section name: .text entropy: 7.74398552475

Source: 7.0.lg5wG9Xf5M.exe.400000.12.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 7.0.lg5wG9Xf5M.exe.400000.12.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 7.0.lg5wG9Xf5M.exe.400000.8.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 7.0.lg5wG9Xf5M.exe.400000.8.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 7.0.lg5wG9Xf5M.exe.400000.10.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 7.0.lg5wG9Xf5M.exe.400000.10.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 7.2.lg5wG9Xf5M.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 7.2.lg5wG9Xf5M.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 7.0.lg5wG9Xf5M.exe.400000.4.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 7.0.lg5wG9Xf5M.exe.400000.4.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	File created: C:\Users\user\AppData\Roaming\WabPKzGkhbokAF.exe			Jump to dropped file
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe			Jump to dropped file

Source: Yara match	File source: 00000012.00000002.533946603.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.533947894.0000000002901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.567673177.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.420348945.00000000031C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lg5wG9Xf5M.exe PID: 7004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lg5wG9Xf5M.exe PID: 5420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 7064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 6408, type: MEMORYSTR

Source: lg5wG9Xf5M.exe, 00000001.00000002.420348945.00000000031C1000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 0000000E.00000002.533947894.0000000002901000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000012.00000002.533946603.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000015.00000002.567673177.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: lg5wG9Xf5M.exe, 00000001.00000002.420348945.00000000031C1000.00000004.00000800.00020000.00000000.sdmp, lg5wG9Xf5M.exe, 0000000E.00000002.533947894.0000000002901000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000012.00000002.533946603.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000015.00000002.567673177.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe TID: 7008	Thread sleep time: -45733s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe TID: 7056	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2992	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe TID: 900	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe TID: 3172	Thread sleep time: -45733s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe TID: 6516	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 6772	Thread sleep time: -45733s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 7136	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4892	Thread sleep time: -45733s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4992	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6364	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3176	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1008	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6352	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe TID: 3580	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6553	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2023	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Window / User API: threadDelayed 6161	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Window / User API: threadDelayed 3150	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Window / User API: foregroundWindowGot 562	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3506
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3302

Windows Analysis Report lg5wG9Xf5M.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
lg5wG9Xf5M.exe

Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Thread delayed: delay time: 45733	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Thread delayed: delay time: 45733	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 45733
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 45733
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Thread delayed: delay time: 922337203685477

Source: dhcpmon.exe, 00000015.00000002.567673177.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 00000015.00000002.567673177.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: dhcpmon.exe, 00000015.00000002.567673177.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: lg5wG9Xf5M.exe, 00000007.00000002.623100634.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: dhcpmon.exe, 00000015.00000002.567673177.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Memory written: C:\Users\user\Desktop\lg5wG9Xf5M.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\lg5wG9Xf5M.exe	Memory written: C:\Users\user\Desktop\lg5wG9Xf5M.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe base: 400000 value starts with: 4D5A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe base: 400000 value starts with: 4D5A

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
102.89.42.162	fastspeed.ddnsfree.com	Nigeria		29465	VCG-ASNG	false
185.19.85.160	unknown	Switzerland		48971	DATAWIRE-ASCH	true

ID:	623791
Product:	CloudBasic
Start time:	20:24:36
Start date:	10.05.2022
Sample:	lg5wG9Xf5M.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	0d8cb66d31ac86cd924b8d279a08f638
SHA1:	67027cf108b3d6c2f70213bb6a2092203563a905
SHA256:	73f9ccea6a86d11af4bdc6b570e4bf7089e89eafe5f8e27af428fce982b1938b
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Name	Type	MD5	SHA1	SHA256
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	0D8CB66D31AC86CD924B8D279A08F638	67027CF108B3D6C2F70213BB6A2092203563A905	73F9CCEA6A86D11AF4BDC6B570E4BF7089E89EAFE5F8E27AF428FCE982B1938B
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log	ASCII text, with CRLF line terminators	2E016B886BDB8389D2DD0867BE55F87B	25D28EF2ACBB41764571E06E11BF4C05DD0E2F8B	1D037CF00A8849E6866603297F85D3DABE09535E72EDD2636FB7D0F6C7DA3427
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lg5wG9Xf5M.exe.log	ASCII text, with CRLF line terminators	2E016B886BDB8389D2DD0867BE55F87B	25D28EF2ACBB41764571E06E11BF4C05DD0E2F8B	1D037CF00A8849E6866603297F85D3DABE09535E72EDD2636FB7D0F6C7DA3427
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	data	C5A56B913DEEDCF5AE01A2D4F8AA69CE	C91D19BFD666FDD02B0739893833D4E1C0316511	1C5C865E5A98F33E277A81FCDADFBAB1367176BA14F8590022F7E5880161C00D
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	BB6466AE0E57E1A5B6A6D1AAC9BC2650	3324E702FE9E3D2FD8DF5764A2BF5F8221113AAD	4DBD2A936FFAACD2194E70056EA54E0A23EDF615DE53BD6163D5E6ADBF3BB830
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2kaofr4h.dki.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_csjag2jj.iwq.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jgwpau5m.h5c.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vxovplek.mhy.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqgcm2tz.zq0.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zgi5sfnl.lee.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\tmp7FCF.tmp	XML 1.0 document, ASCII text	6453ED2F740144C6FC8297E67823A89B	05F61C06F9E0DD8223FDFCF0E248CC80696E621D	AC9887D24365BC32147AA267C8559486571B5537D35621568F55134B98604203
C:\Users\user\AppData\Local\Temp\tmpA171.tmp	XML 1.0 document, ASCII text	6453ED2F740144C6FC8297E67823A89B	05F61C06F9E0DD8223FDFCF0E248CC80696E621D	AC9887D24365BC32147AA267C8559486571B5537D35621568F55134B98604203
C:\Users\user\AppData\Local\Temp\tmpB017.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	54A6C3E7F213A8209E37741AB9B5DB1D	80614D1CC06DB27674BD0609A27C36C6FBAB8665	2C344BDBCE81E1C538E09A614F3CD33E37D39F0E8EA11DABC12634E7D4AB6373
C:\Users\user\AppData\Local\Temp\tmpBF4A.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	5C2F41CFC6F988C859DA7D727AC2B62A	68999C85FC7E37BAB9216E0099836D40D4545C1C	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
C:\Users\user\AppData\Local\Temp\tmpCBBD.tmp	XML 1.0 document, ASCII text	6453ED2F740144C6FC8297E67823A89B	05F61C06F9E0DD8223FDFCF0E248CC80696E621D	AC9887D24365BC32147AA267C8559486571B5537D35621568F55134B98604203
C:\Users\user\AppData\Local\Temp\tmpE5A3.tmp	XML 1.0 document, ASCII text	6453ED2F740144C6FC8297E67823A89B	05F61C06F9E0DD8223FDFCF0E248CC80696E621D	AC9887D24365BC32147AA267C8559486571B5537D35621568F55134B98604203
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat	data	BA2E335F6FCD7E4DBD551826E552F8A4	9D052D9A692C5CCEA74EF4E054EF2DC7C847D47A	FE2E4C9E4834F5E14A6FC2FAA56E910E6D14D77EEECAF07275A90E6E5E638624
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat	ASCII text, with no line terminators	4D911C16ED4305325D508C27287877F5	A4605860EA2A22F076CD528AD6394370C3E52926	B0B002EDB35594714EF39F661904BA5B2845F9269BD441508521162DA6D3E77F
C:\Users\user\AppData\Roaming\WabPKzGkhbokAF.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	0D8CB66D31AC86CD924B8D279A08F638	67027CF108B3D6C2F70213BB6A2092203563A905	73F9CCEA6A86D11AF4BDC6B570E4BF7089E89EAFE5F8E27AF428FCE982B1938B
C:\Users\user\AppData\Roaming\WabPKzGkhbokAF.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\Documents\20220510\PowerShell_transcript.367706.GLebQcFV.20220510202659.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	8818D86AAF4768CC63DECB0C02D055E7	E6A5D0B29D04A30691F299C2C03666B22C9AAA5D	03EDB091F14A071CC90B0FEE5D8659B78F91445BE81E74C3BB463A7EEA3C8845
C:\Users\user\Documents\20220510\PowerShell_transcript.367706.fRDTb4sw.20220510202646.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9C9011A6AAF553E5F4110D958A25E99E	F35F478C3D955B0FE3F90FCBE171DC875B303E09	6672E02B6A769250034913C8A200800D33A140A0F0FDD1DF5C4AD6B8CC1C5F33
C:\Users\user\Documents\20220510\PowerShell_transcript.367706.wnZ186tf.20220510202606.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	6F4D5DA3526131CA69D3A3E3C652D6B4	7124156BC96331355C93CC10B9C3B5B0066B4142	FC4D75EB558E701196C48D4441DA85594A32ADA8FAEA679952F49DB5C98E400F